In Google Chrome on Linux, where is the flv if not in /tmp?

linux ubuntu video google-chrome flash

55,018

Solution 1

I observed that the recent Flash plugins do store files in /tmp, but they use a trick of removing them and keeping a filehandle open to keep them alive. This means they are still kept on the drive (as long as the filehandle is opened by flash plugin), but they are not visible in directory listing (because the file has been deleted).

I wrote about this some time age: getting flash videos from almost deleted files

But it all depends on version of Flash plugin. It used to store movies in /tmp or in browser's cache too.

Solution 2

Checking /proc//fd/ did the trick for me:

$ ps x | grep npviewer
24657 ?        Sl    12:33 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin ...
$ cd /proc/24657/fd
$ ls -l
total 0
lr-x------ 1 omab omab 64 2011-02-11 02:13 0 -> /dev/null
lrwx------ 1 omab omab 64 2011-02-11 02:13 1 -> /home/omab/.xsession-errors
lr-x------ 1 omab omab 64 2011-02-11 02:13 10 -> /home/omab/.mozilla/firefox/og3emjry.default/key3.db
lrwx------ 1 omab omab 64 2011-02-11 02:13 11 -> /tmp/FlashXX0WG0J5 (deleted)
lr-x------ 1 omab omab 64 2011-02-11 02:13 12 -> pipe:[9004372]
...

The file 11, the one marked as "(deleted)", still points to the file originally created on /tmp/, so it's not completely deleted:

$ file -L 11 
11: Macromedia Flash Video

doing an:

$ mplayer 11

will reproduce the FLV file.

Here is a quite handy command line adapted from the above procedure. It may require minor adjustments for your distribution / installation and what processes you're usually running.

You can replace flash with npviewer, replace vlc with mplayer:

FLASHPID=\`pgrep -f flash\`; vlc /proc/$FLASHPID/fd/\`ls -l /proc/$FLASHPID/fd | grep tmp | cut -d" " -f9\`

Solution 3

Flash streams most of the time are simple file get by an http request.

For your video at http://blip.tv/file/3627639

In Google Chrome you can inspect network requests (ctrl + shift + i) look for the longest to finish in your case :

Fosslc-..
/file/get

click on it and copy/paste url from 'Request URL' field, to a new tab

http://blip.tv/file/get/Fosslc-2...to823.flv?showplayer=20110401114509&source=1

Solution 4

Yang,

Yeah, it's in ~/.cache/google-chrome/Cache (well, I have Chromium installed so I found it in ~/.cache/chromium/Cache).

If you watch the video and sort by time stamp:

$ ls -rt | tail
f_00003a
f_00003b
f_00003c
f_00003d
data_2
data_3
index
data_1
f_000040
data_0

Then if you run the file command you'll see which ones are Flash:

$ file $(ls -rt | tail)
f_00003a: Macromedia Flash data (compressed), version 9
f_00003b: Macromedia Flash data (compressed), version 9
f_00003c: Macromedia Flash data (compressed), version 10
f_00003d: PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
data_2:   data
data_3:   data
index:    data
data_1:   data
f_000040: Macromedia Flash Video
data_0:   data

OK, I installed Google Chrome to check it out.

Looks like the directory for Google Chrome is slightly different from Chromium.

Using the same techniques (here specifying the process ID of the browser, output removed some columns for clarity):

$ lsof -p 27922 | grep Cache
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/index
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_3
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_2
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_1
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_0
chrome  27922  71u    ~/.cache/google-chrome/Default/Cache/index
chrome  27922  72u    ~/.cache/google-chrome/Default/Cache/data_0
chrome  27922  73u    ~/.cache/google-chrome/Default/Cache/data_1
chrome  27922  74u    ~/.cache/google-chrome/Default/Cache/data_2
chrome  27922  75u    ~/.cache/google-chrome/Default/Cache/data_3
chrome  27922 111u    ~/.cache/google-chrome/Default/Cache/f_00001a

Solution 5

using chromium 11.0.666.0, and flash plug-in 10.2.152

grepping for npviewer did not produce any flash process for me but grepping for flash does:

$ ps x | grep flash
11005 ?        Rl     2:30 /usr/lib/chromium-browser/chromium-browser ...

basically same thing as jyap above suggested with

lsof | grep Flash

and you can then proceed as above...

View more solutions

55,018

Yang

Updated on September 17, 2022

Comments

Yang over 1 year

I like to keep videos because

I like buffering them and then playing them back-to-back in my media player,
I want to be able to stop/restart my browser without losing all the buffered video, and
Flash frequently crashes and gives me the gray boxes.

For many sites with Flash video (including Youtube), I can find the flv file in /tmp, usually named FlashXX.... But some sites manage to prevent this file from showing up, e.g. http://blip.tv/file/3627639. It's possible this isn't spooled to disk at all, but that would be surprising since the entire hour-long video can be buffered without my RAM being noticeably impacted.

In Firefox, I can find the flv inside its cache directory. But I'm curious how to do this in Chrome. I tried looking under ~/.cache/google-chrome/ but didn't find anything that looked right. For instance:

$ ls -lt .cache/google-chrome/Cache/ | head
total 261492
-rw------- 1 yang yang 16621568 2010-12-05 03:41 data_1
-rw------- 1 yang yang   966656 2010-12-05 03:40 data_0
-rw------- 1 yang yang 23076864 2010-12-05 03:40 data_2
-rw------- 1 yang yang   262512 2010-12-05 03:40 index
-rw------- 1 yang yang   108412 2010-12-05 03:35 f_005603
-rw------- 1 yang yang    62607 2010-12-05 03:32 f_005602
-rw------- 1 yang yang    54998 2010-12-05 03:32 f_005601
-rw------- 1 yang yang    31127 2010-12-05 03:32 f_005600
-rw------- 1 yang yang   799389 2010-12-05 03:32 f_0055ff

$ ls -1t ~/.cache/google-chrome/Cache/* | head | xargs file
/home/yang/.cache/google-chrome/Cache/data_1:   data
/home/yang/.cache/google-chrome/Cache/data_0:   data
/home/yang/.cache/google-chrome/Cache/data_2:   data
/home/yang/.cache/google-chrome/Cache/index:    data
/home/yang/.cache/google-chrome/Cache/f_005603: GIF image data, version 89a, 600 x 471
/home/yang/.cache/google-chrome/Cache/f_005602: PNG image, 600 x 746, 8-bit colormap, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005601: PNG image, 140 x 342, 8-bit/color RGB, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005600: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055ff: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055fe: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)

I tried looking at the open files for the Flash process, but didn't see any deleted Flash files, which a bunch of the answers below say should exist:

$ ps x | grep npviewer
27148 ?        Rl     0:24 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin --plugin /usr/lib/flashplugin-installer/libflashplayer.so --connection /org/wrapper/NSPlugins/libflashplayer.so/27135-2
27504 pts/2    S+     0:00 grep --color=auto npviewer

$ ls -l /proc/27148/fd/
total 0
lr-x------ 1 yang yang 64 2011-02-16 13:48 0 -> /dev/null
lrwx------ 1 yang yang 64 2011-02-16 13:48 1 -> /home/yang/.xsession-errors
l-wx------ 1 yang yang 64 2011-02-16 13:48 10 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/key3.db
lrwx------ 1 yang yang 64 2011-02-16 13:48 11 -> pipe:[5500575]
lrwx------ 1 yang yang 64 2011-02-16 13:48 12 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 13 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 14 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 15 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 16 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 17 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 18 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 19 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 2 -> /home/yang/.xsession-errors
lrwx------ 1 yang yang 64 2011-02-16 13:48 20 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 21 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 22 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 23 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 24 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 25 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 26 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 27 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 28 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 29 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 3 -> socket:[5496032]
lrwx------ 1 yang yang 64 2011-02-16 13:51 30 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 31 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 32 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 33 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 34 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 35 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:53 36 -> pipe:[5500575]
lr-x------ 1 yang yang 64 2011-02-16 13:53 37 -> pipe:[5500576]
l-wx------ 1 yang yang 64 2011-02-16 13:53 38 -> pipe:[5500576]
lrwx------ 1 yang yang 64 2011-02-16 13:53 39 -> socket:[5500580]
lrwx------ 1 yang yang 64 2011-02-16 13:48 4 -> socket:[5496131]
lr-x------ 1 yang yang 64 2011-02-16 13:48 5 -> pipe:[5496139]
l-wx------ 1 yang yang 64 2011-02-16 13:48 6 -> pipe:[5496139]
lr-x------ 1 yang yang 64 2011-02-16 13:48 7 -> socket:[5496140]
l-wx------ 1 yang yang 64 2011-02-16 13:48 8 -> socket:[5496141]
lr-x------ 1 yang yang 64 2011-02-16 13:48 9 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/cert8.db

I tried straceing all the chrome processes for anything that looked like it might be writing a file:

strace -p (pgrep chrome|xargs -I_ echo -p _)

but looking at the write/writev/select calls only pointed me to a few FDs that /proc/_/fd/ showed to be pipes/sockets (presumably for the processes to talk to each other). Also tried the same thing on the npviewer.bin process.

I also tried to simply inspect all the files pointed to in /proc/*/fd/ (any processes) that were recently modified, but didn't find anything that looked like it contained a flv. I also tried the same check on the recently modified files under ~/.cache/google-chrome/.

If it makes a difference, I'm using the dev channel release of Chrome, which I believe (always?) uses its own secure Flash implementation. At the moment of this update, I'm using Chrome 10.0.648.45 dev. According to http://www.adobe.com/software/flash/about/ I'm running 10.2.152.27. I've tried on several Ubuntu boxes now. I've also tried on several Ubuntu boxes now, with the same results.

Any others want to take a stab at this?

Yang over 13 years

Did this work for you? Doesn't turn up anything for me - I wouldn't guess that it would either, given that the typical Flash* files aren't showing up in their usual location.
Yang over 13 years

That's intriguing, because it doesn't work for me. I updated my answer with a paste of what I see. Does it work for you with the example blip.tv URL I gave? Maybe it's because of a different version of Chrome - which are you using?
cestMoiBaliBalo over 13 years

Yeah I used your exact URL. Were you playing the file while running the commands? Try clearing your cache, playing the file and then run the commands. It worked for me and I could play the file in Mplayer so it worked for me!
Yang over 13 years

Your very interesting blog post describes doing this with Firefox, but I'm wondering how to do this using Chrome. I've been looking at lsof and /proc, but haven't found any signs of unlinked files. Have you had success with the example video?
liori over 13 years

@Yang: The same exact way works with chrome, at least on my notebook--just tested. I think it depends more on flash player than on webbrowser. What version of Flash plugin do you have?
Yang about 13 years

According to adobe.com/software/flash/about I'm running 10.2.152.27, which I think is the Flash built in to Chrome (using Chrome 10.0.648.45 dev). I've tried on several Ubuntu boxes now.
Yang about 13 years

Alas, clearing the cache didn't help. Yes, the file was playing while I was running these commands. Updated my answer with more information. Some answerers say I should be looking at the Flash process, others say I should look at one of the browser processes, but I've tried both, even looking at all processes. Any ideas on why it's broken for me? I've tried on several machines now.
Yang about 13 years

This doesn't work for me - I updated my answer with details of what I see. Do you know why it might not be working for me? I tried on several machines now.
cestMoiBaliBalo about 13 years

I edited my answer above to specify the process ID of Google Chrome and running the lsof command. Try that out.
Baderous about 13 years

BTW, you can save the flv with mplayer 11 -dumpstream -dumpfile outputname
omab about 13 years

You can just copy it cp 11 /.../...
Doud about 13 years

please don't accept it, since it's just a trick for your case. I really want to know where the hell flash store temporary video files.
Yang about 13 years

Heh, all right. I do want to know as well. My hunch is that it's getting stored somewhere in the data_* files, which are probably browser-specific heaps. I couldn't find any tool to rummage through them, though, short of diving into the Chrome code base.
HackToHell over 11 years

@Yang I can confirm that it works with chrome
liori over 11 years

As a note, it seems that while it used to work with all flash movie players, it is not the case anymore. It seems to work with some less known sites, but not Youtube. I can only guess that Youtube found a way to keep the file off the filesystem…
Yang over 11 years

@liori This is exactly my experience nowadays. I.e., the flv may or may not be accessible via /proc/. Not sure if Flash Pepper (PPAPI) is part of the problem.
user66001 over 10 years

While this is helpful info, and bearing in mind I don't know how to probe RAM (just that it is possible), I don't agree that you "won't be able to get anything". Where there is a will, there is a way.
jopasserat almost 10 years

it still works for me with Chromium version 33.0.1750.152-1 (Debian Jessie) and flashplayer version 11,2,202,346 (according to adobe.com/software/flash/about)