In Google Chrome on Linux, where is the flv if not in /tmp?

Question

I like to keep videos because

I like buffering them and then playing them back-to-back in my media player,
I want to be able to stop/restart my browser without losing all the buffered video, and
Flash frequently crashes and gives me the gray boxes.

For many sites with Flash video (including Youtube), I can find the flv file in /tmp, usually named FlashXX.... But some sites manage to prevent this file from showing up, e.g. http://blip.tv/file/3627639. It's possible this isn't spooled to disk at all, but that would be surprising since the entire hour-long video can be buffered without my RAM being noticeably impacted.

In Firefox, I can find the flv inside its cache directory. But I'm curious how to do this in Chrome. I tried looking under ~/.cache/google-chrome/ but didn't find anything that looked right. For instance:

$ ls -lt .cache/google-chrome/Cache/ | head
total 261492
-rw------- 1 yang yang 16621568 2010-12-05 03:41 data_1
-rw------- 1 yang yang   966656 2010-12-05 03:40 data_0
-rw------- 1 yang yang 23076864 2010-12-05 03:40 data_2
-rw------- 1 yang yang   262512 2010-12-05 03:40 index
-rw------- 1 yang yang   108412 2010-12-05 03:35 f_005603
-rw------- 1 yang yang    62607 2010-12-05 03:32 f_005602
-rw------- 1 yang yang    54998 2010-12-05 03:32 f_005601
-rw------- 1 yang yang    31127 2010-12-05 03:32 f_005600
-rw------- 1 yang yang   799389 2010-12-05 03:32 f_0055ff

$ ls -1t ~/.cache/google-chrome/Cache/* | head | xargs file
/home/yang/.cache/google-chrome/Cache/data_1:   data
/home/yang/.cache/google-chrome/Cache/data_0:   data
/home/yang/.cache/google-chrome/Cache/data_2:   data
/home/yang/.cache/google-chrome/Cache/index:    data
/home/yang/.cache/google-chrome/Cache/f_005603: GIF image data, version 89a, 600 x 471
/home/yang/.cache/google-chrome/Cache/f_005602: PNG image, 600 x 746, 8-bit colormap, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005601: PNG image, 140 x 342, 8-bit/color RGB, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005600: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055ff: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055fe: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)

I tried looking at the open files for the Flash process, but didn't see any deleted Flash files, which a bunch of the answers below say should exist:

$ ps x | grep npviewer
27148 ?        Rl     0:24 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin --plugin /usr/lib/flashplugin-installer/libflashplayer.so --connection /org/wrapper/NSPlugins/libflashplayer.so/27135-2
27504 pts/2    S+     0:00 grep --color=auto npviewer

$ ls -l /proc/27148/fd/
total 0
lr-x------ 1 yang yang 64 2011-02-16 13:48 0 -> /dev/null
lrwx------ 1 yang yang 64 2011-02-16 13:48 1 -> /home/yang/.xsession-errors
l-wx------ 1 yang yang 64 2011-02-16 13:48 10 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/key3.db
lrwx------ 1 yang yang 64 2011-02-16 13:48 11 -> pipe:[5500575]
lrwx------ 1 yang yang 64 2011-02-16 13:48 12 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 13 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 14 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 15 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 16 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 17 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 18 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 19 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 2 -> /home/yang/.xsession-errors
lrwx------ 1 yang yang 64 2011-02-16 13:48 20 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 21 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 22 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 23 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 24 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 25 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 26 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 27 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 28 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 29 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 3 -> socket:[5496032]
lrwx------ 1 yang yang 64 2011-02-16 13:51 30 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 31 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 32 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 33 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 34 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 35 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:53 36 -> pipe:[5500575]
lr-x------ 1 yang yang 64 2011-02-16 13:53 37 -> pipe:[5500576]
l-wx------ 1 yang yang 64 2011-02-16 13:53 38 -> pipe:[5500576]
lrwx------ 1 yang yang 64 2011-02-16 13:53 39 -> socket:[5500580]
lrwx------ 1 yang yang 64 2011-02-16 13:48 4 -> socket:[5496131]
lr-x------ 1 yang yang 64 2011-02-16 13:48 5 -> pipe:[5496139]
l-wx------ 1 yang yang 64 2011-02-16 13:48 6 -> pipe:[5496139]
lr-x------ 1 yang yang 64 2011-02-16 13:48 7 -> socket:[5496140]
l-wx------ 1 yang yang 64 2011-02-16 13:48 8 -> socket:[5496141]
lr-x------ 1 yang yang 64 2011-02-16 13:48 9 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/cert8.db

I tried straceing all the chrome processes for anything that looked like it might be writing a file:

strace -p (pgrep chrome|xargs -I_ echo -p _)

but looking at the write/writev/select calls only pointed me to a few FDs that /proc/_/fd/ showed to be pipes/sockets (presumably for the processes to talk to each other). Also tried the same thing on the npviewer.bin process.

I also tried to simply inspect all the files pointed to in /proc/*/fd/ (any processes) that were recently modified, but didn't find anything that looked like it contained a flv. I also tried the same check on the recently modified files under ~/.cache/google-chrome/.

If it makes a difference, I'm using the dev channel release of Chrome, which I believe (always?) uses its own secure Flash implementation. At the moment of this update, I'm using Chrome 10.0.648.45 dev. According to http://www.adobe.com/software/flash/about/ I'm running 10.2.152.27. I've tried on several Ubuntu boxes now. I've also tried on several Ubuntu boxes now, with the same results.

Any others want to take a stab at this?

score 31 · Answer 1 · answered Feb 08 '11 at 09:58

I observed that the recent Flash plugins do store files in /tmp, but they use a trick of removing them and keeping a filehandle open to keep them alive. This means they are still kept on the drive (as long as the filehandle is opened by flash plugin), but they are not visible in directory listing (because the file has been deleted).

I wrote about this some time age: getting flash videos from almost deleted files

But it all depends on version of Flash plugin. It used to store movies in /tmp or in browser's cache too.

score 24 · Answer 2 · edited Jan 27 '12 at 22:07

Checking /proc//fd/ did the trick for me:

$ ps x | grep npviewer
24657 ?        Sl    12:33 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin ...
$ cd /proc/24657/fd
$ ls -l
total 0
lr-x------ 1 omab omab 64 2011-02-11 02:13 0 -> /dev/null
lrwx------ 1 omab omab 64 2011-02-11 02:13 1 -> /home/omab/.xsession-errors
lr-x------ 1 omab omab 64 2011-02-11 02:13 10 -> /home/omab/.mozilla/firefox/og3emjry.default/key3.db
lrwx------ 1 omab omab 64 2011-02-11 02:13 11 -> /tmp/FlashXX0WG0J5 (deleted)
lr-x------ 1 omab omab 64 2011-02-11 02:13 12 -> pipe:[9004372]
...

The file 11, the one marked as "(deleted)", still points to the file originally created on /tmp/, so it's not completely deleted:

$ file -L 11 
11: Macromedia Flash Video

doing an:

$ mplayer 11

will reproduce the FLV file.

Here is a quite handy command line adapted from the above procedure. It may require minor adjustments for your distribution / installation and what processes you're usually running.

You can replace flash with npviewer, replace vlc with mplayer:

FLASHPID=\`pgrep -f flash\`; vlc /proc/$FLASHPID/fd/\`ls -l /proc/$FLASHPID/fd | grep tmp | cut -d" " -f9\`

score 10 · Answer 3 · edited Jan 27 '12 at 22:08

Flash streams most of the time are simple file get by an http request.

For your video at http://blip.tv/file/3627639

In Google Chrome you can inspect network requests (ctrl + shift + i) look for the longest to finish in your case :

Fosslc-..
/file/get

click on it and copy/paste url from 'Request URL' field, to a new tab

http://blip.tv/file/get/Fosslc-2...to823.flv?showplayer=20110401114509&source=1

jyap · Answer 4 · 2011-02-08T09:20:01.783

Yang,

Yeah, it's in ~/.cache/google-chrome/Cache (well, I have Chromium installed so I found it in ~/.cache/chromium/Cache).

If you watch the video and sort by time stamp:

$ ls -rt | tail
f_00003a
f_00003b
f_00003c
f_00003d
data_2
data_3
index
data_1
f_000040
data_0

Then if you run the file command you'll see which ones are Flash:

$ file $(ls -rt | tail)
f_00003a: Macromedia Flash data (compressed), version 9
f_00003b: Macromedia Flash data (compressed), version 9
f_00003c: Macromedia Flash data (compressed), version 10
f_00003d: PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
data_2:   data
data_3:   data
index:    data
data_1:   data
f_000040: Macromedia Flash Video
data_0:   data

OK, I installed Google Chrome to check it out.

Looks like the directory for Google Chrome is slightly different from Chromium.

Using the same techniques (here specifying the process ID of the browser, output removed some columns for clarity):

$ lsof -p 27922 | grep Cache
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/index
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_3
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_2
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_1
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_0
chrome  27922  71u    ~/.cache/google-chrome/Default/Cache/index
chrome  27922  72u    ~/.cache/google-chrome/Default/Cache/data_0
chrome  27922  73u    ~/.cache/google-chrome/Default/Cache/data_1
chrome  27922  74u    ~/.cache/google-chrome/Default/Cache/data_2
chrome  27922  75u    ~/.cache/google-chrome/Default/Cache/data_3
chrome  27922 111u    ~/.cache/google-chrome/Default/Cache/f_00001a

score 5 · Answer 5 · answered Feb 15 '11 at 07:26

using chromium 11.0.666.0, and flash plug-in 10.2.152

grepping for npviewer did not produce any flash process for me but grepping for flash does:

$ ps x | grep flash
11005 ?        Rl     2:30 /usr/lib/chromium-browser/chromium-browser ...

basically same thing as jyap above suggested with

lsof | grep Flash

and you can then proceed as above...

score 3 · Answer 6 · answered Feb 04 '11 at 23:54

3

Try listing out the open files.

lsof | grep Flash

answered Feb 04 '11 at 23:54

jyap

249

score 3 · Answer 7 · answered Mar 14 '11 at 03:09

3

Some of the newer players buffer in memory to try to make it impossible for people to use these tricks. You won't be able to get anything in that case.

answered Mar 14 '11 at 03:09

geekosaur

12,091

score 3 · Answer 8 · answered Mar 19 '11 at 20:43

I fixed this issue. Here the steps are

Goto installed plugins about:plugins in chrome / mozilla
Click Details to view with more information. Disable the Flash Plugin. The Location of the plugin would be “/usr/lib/adobe-flashplugin/libflashplayer.so”
Download the tar.gz version of flash player from here http://get.adobe.com/flashplayer/
Extract that file and copy the libflashplayer.so to /usr/lib/chromium-browser/plugins . Then Enable this in plugin page.
If you view any video it will download in /home//.cache/chromium/Default/Cache this folder

have a look http://www.arulraj.net/2011/03/google-chrome-download-video.html

score 2 · Answer 9 · edited May 20 '11 at 08:24

For the latest Chrome on Linux:

Identify the pid of the Flash plugin used by Chrome:
```
ps ax | grep -i chrome | grep -i flash 
```
as of now the plugin is called libgcflashplayer.

Identify the Flash file opened by this Flash plugin process:

file /proc/Flash_Plugin_PID/fd/* | grep -i deleted

or

lsof -p Flash_plugin_pid | grep -i deleted

Look for deleted files.

Copy the file from /proc/[pid]/fd/[fileno] to recovered_file.flv

score 2 · Answer 10 · answered Jun 06 '11 at 21:23

2

I'm using chrome 11.06 on Ubuntu 10.04. I found my flv files in ~/.cache/google-chrome/Default/Cache. Try a

file * | grep Flash\ Video

answered Jun 06 '11 at 21:23

user733032

121

score 2 · Answer 11 · edited Sep 26 '11 at 16:16

A little tip from me. This works in Ubuntu 10.04.

#!/bin/bash
viewer=`ps x|grep npviewer|grep -v grep |awk '{print $1}'`
echo $viewer
cd /proc/${viewer}/fd
jef=(`ls -l|awk '{print $8 " " $10}'|grep Flash|awk '{print $1}'`)
echo $jef
jef1=${#jef}
ext=`date +'%d_%m_%k_%M_%S'`
i=0
while [ "$i" -lt "$jef1" ]
do 
cp ${jef[${i}]} /fun/${jef[${i}]}"(${ext})".flv
i=`expr $i + 1`
done

Now you can schedule this script with the crontab. It could be optimized so that there are no duplicate FLV files.

score 2 · Answer 12 · edited Oct 06 '11 at 07:15

2

Using Firefox on Kubuntu:

export COUNT=0
export FILENAME=$1
export FILENAME=${FILENAME:=test}

PID=`ps ax | grep -i flashplugi[n] | awk '{print $1}'`
FLASH=`ls -l /proc/$PID/fd| grep Flash | awk '{print $8}'`

for N in $FLASH ; do
  COUNT=$(($COUNT+1))
  cp /proc/$PID/fd/$N ${FILENAME}_${COUNT}.flv
done

edited Oct 06 '11 at 07:15

slhck

235,242

answered Oct 06 '11 at 02:54

verzonnen

21
1

Gilles Quénot · Answer 13 · 2012-04-02T03:23:50.323

I have another way to do it based on the file descriptor founded in /proc (I use modern bash in a few lines)

#!/bin/bash

process="flash"
filename="flash"

readlink -f /proc/$$/exe | fgrep -q bash || {
    echo >&2 "Hey dude ! You must call $0 with bash !"
    exit 2
}

. ~/.bashrc || . /etc/profile

count=1
for pid in $(pgrep -f $process); do
    fds=$(file /proc/$pid/fd/[0-9]* | fgrep Flash | cut -d: -f1)
    for fd in $fds; do
        cp -v $fd ${filename}_${count}.flv
        ((count++))
    done
done

# vim:ts=4:sw=4

In Google Chrome on Linux, where is the flv if not in /tmp?

13 Answers13

Linked