37

I like to keep videos because

  1. I like buffering them and then playing them back-to-back in my media player,
  2. I want to be able to stop/restart my browser without losing all the buffered video, and
  3. Flash frequently crashes and gives me the gray boxes.

For many sites with Flash video (including Youtube), I can find the flv file in /tmp, usually named FlashXX.... But some sites manage to prevent this file from showing up, e.g. http://blip.tv/file/3627639. It's possible this isn't spooled to disk at all, but that would be surprising since the entire hour-long video can be buffered without my RAM being noticeably impacted.

In Firefox, I can find the flv inside its cache directory. But I'm curious how to do this in Chrome. I tried looking under ~/.cache/google-chrome/ but didn't find anything that looked right. For instance:

$ ls -lt .cache/google-chrome/Cache/ | head
total 261492
-rw------- 1 yang yang 16621568 2010-12-05 03:41 data_1
-rw------- 1 yang yang   966656 2010-12-05 03:40 data_0
-rw------- 1 yang yang 23076864 2010-12-05 03:40 data_2
-rw------- 1 yang yang   262512 2010-12-05 03:40 index
-rw------- 1 yang yang   108412 2010-12-05 03:35 f_005603
-rw------- 1 yang yang    62607 2010-12-05 03:32 f_005602
-rw------- 1 yang yang    54998 2010-12-05 03:32 f_005601
-rw------- 1 yang yang    31127 2010-12-05 03:32 f_005600
-rw------- 1 yang yang   799389 2010-12-05 03:32 f_0055ff

$ ls -1t ~/.cache/google-chrome/Cache/* | head | xargs file
/home/yang/.cache/google-chrome/Cache/data_1:   data
/home/yang/.cache/google-chrome/Cache/data_0:   data
/home/yang/.cache/google-chrome/Cache/data_2:   data
/home/yang/.cache/google-chrome/Cache/index:    data
/home/yang/.cache/google-chrome/Cache/f_005603: GIF image data, version 89a, 600 x 471
/home/yang/.cache/google-chrome/Cache/f_005602: PNG image, 600 x 746, 8-bit colormap, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005601: PNG image, 140 x 342, 8-bit/color RGB, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005600: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055ff: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055fe: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)

I tried looking at the open files for the Flash process, but didn't see any deleted Flash files, which a bunch of the answers below say should exist:

$ ps x | grep npviewer
27148 ?        Rl     0:24 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin --plugin /usr/lib/flashplugin-installer/libflashplayer.so --connection /org/wrapper/NSPlugins/libflashplayer.so/27135-2
27504 pts/2    S+     0:00 grep --color=auto npviewer

$ ls -l /proc/27148/fd/
total 0
lr-x------ 1 yang yang 64 2011-02-16 13:48 0 -> /dev/null
lrwx------ 1 yang yang 64 2011-02-16 13:48 1 -> /home/yang/.xsession-errors
l-wx------ 1 yang yang 64 2011-02-16 13:48 10 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/key3.db
lrwx------ 1 yang yang 64 2011-02-16 13:48 11 -> pipe:[5500575]
lrwx------ 1 yang yang 64 2011-02-16 13:48 12 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 13 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 14 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 15 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 16 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 17 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 18 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 19 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 2 -> /home/yang/.xsession-errors
lrwx------ 1 yang yang 64 2011-02-16 13:48 20 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 21 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 22 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 23 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 24 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 25 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 26 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 27 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 28 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 29 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 3 -> socket:[5496032]
lrwx------ 1 yang yang 64 2011-02-16 13:51 30 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 31 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 32 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 33 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 34 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 35 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:53 36 -> pipe:[5500575]
lr-x------ 1 yang yang 64 2011-02-16 13:53 37 -> pipe:[5500576]
l-wx------ 1 yang yang 64 2011-02-16 13:53 38 -> pipe:[5500576]
lrwx------ 1 yang yang 64 2011-02-16 13:53 39 -> socket:[5500580]
lrwx------ 1 yang yang 64 2011-02-16 13:48 4 -> socket:[5496131]
lr-x------ 1 yang yang 64 2011-02-16 13:48 5 -> pipe:[5496139]
l-wx------ 1 yang yang 64 2011-02-16 13:48 6 -> pipe:[5496139]
lr-x------ 1 yang yang 64 2011-02-16 13:48 7 -> socket:[5496140]
l-wx------ 1 yang yang 64 2011-02-16 13:48 8 -> socket:[5496141]
lr-x------ 1 yang yang 64 2011-02-16 13:48 9 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/cert8.db

I tried straceing all the chrome processes for anything that looked like it might be writing a file:

strace -p (pgrep chrome|xargs -I_ echo -p _)

but looking at the write/writev/select calls only pointed me to a few FDs that /proc/_/fd/ showed to be pipes/sockets (presumably for the processes to talk to each other). Also tried the same thing on the npviewer.bin process.

I also tried to simply inspect all the files pointed to in /proc/*/fd/ (any processes) that were recently modified, but didn't find anything that looked like it contained a flv. I also tried the same check on the recently modified files under ~/.cache/google-chrome/.

If it makes a difference, I'm using the dev channel release of Chrome, which I believe (always?) uses its own secure Flash implementation. At the moment of this update, I'm using Chrome 10.0.648.45 dev. According to http://www.adobe.com/software/flash/about/ I'm running 10.2.152.27. I've tried on several Ubuntu boxes now. I've also tried on several Ubuntu boxes now, with the same results.

Any others want to take a stab at this?

2
  • It might help if you provided the link to a page that you're having trouble with. Jan 20, 2011 at 7:17
  • @Ben: Oops, I meant to do that. Added!
    – xyzzyrz
    Jan 20, 2011 at 10:14

13 Answers 13

31

I observed that the recent Flash plugins do store files in /tmp, but they use a trick of removing them and keeping a filehandle open to keep them alive. This means they are still kept on the drive (as long as the filehandle is opened by flash plugin), but they are not visible in directory listing (because the file has been deleted).

I wrote about this some time age: getting flash videos from almost deleted files

But it all depends on version of Flash plugin. It used to store movies in /tmp or in browser's cache too.

7
  • Your very interesting blog post describes doing this with Firefox, but I'm wondering how to do this using Chrome. I've been looking at lsof and /proc, but haven't found any signs of unlinked files. Have you had success with the example video?
    – xyzzyrz
    Feb 10, 2011 at 4:05
  • 1
    @Yang: The same exact way works with chrome, at least on my notebook--just tested. I think it depends more on flash player than on webbrowser. What version of Flash plugin do you have?
    – liori
    Feb 10, 2011 at 11:08
  • According to adobe.com/software/flash/about I'm running 10.2.152.27, which I think is the Flash built in to Chrome (using Chrome 10.0.648.45 dev). I've tried on several Ubuntu boxes now.
    – xyzzyrz
    Feb 16, 2011 at 21:57
  • 2
    As a note, it seems that while it used to work with all flash movie players, it is not the case anymore. It seems to work with some less known sites, but not Youtube. I can only guess that Youtube found a way to keep the file off the filesystem…
    – liori
    Sep 9, 2012 at 13:30
  • 1
    it still works for me with Chromium version 33.0.1750.152-1 (Debian Jessie) and flashplayer version 11,2,202,346 (according to adobe.com/software/flash/about)
    – jopasserat
    May 20, 2014 at 10:51
24

Checking /proc//fd/ did the trick for me:

$ ps x | grep npviewer
24657 ?        Sl    12:33 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin ...
$ cd /proc/24657/fd
$ ls -l
total 0
lr-x------ 1 omab omab 64 2011-02-11 02:13 0 -> /dev/null
lrwx------ 1 omab omab 64 2011-02-11 02:13 1 -> /home/omab/.xsession-errors
lr-x------ 1 omab omab 64 2011-02-11 02:13 10 -> /home/omab/.mozilla/firefox/og3emjry.default/key3.db
lrwx------ 1 omab omab 64 2011-02-11 02:13 11 -> /tmp/FlashXX0WG0J5 (deleted)
lr-x------ 1 omab omab 64 2011-02-11 02:13 12 -> pipe:[9004372]
...

The file 11, the one marked as "(deleted)", still points to the file originally created on /tmp/, so it's not completely deleted:

$ file -L 11 
11: Macromedia Flash Video

doing an:

$ mplayer 11

will reproduce the FLV file.


Here is a quite handy command line adapted from the above procedure. It may require minor adjustments for your distribution / installation and what processes you're usually running.

You can replace flash with npviewer, replace vlc with mplayer:

FLASHPID=\`pgrep -f flash\`; vlc /proc/$FLASHPID/fd/\`ls -l /proc/$FLASHPID/fd | grep tmp | cut -d" " -f9\`
3
  • This doesn't work for me - I updated my answer with details of what I see. Do you know why it might not be working for me? I tried on several machines now.
    – xyzzyrz
    Feb 16, 2011 at 22:07
  • BTW, you can save the flv with mplayer 11 -dumpstream -dumpfile outputname
    – liewl
    Mar 4, 2011 at 15:20
  • 8
    You can just copy it cp 11 /.../...
    – omab
    Mar 29, 2011 at 5:54
10

Flash streams most of the time are simple file get by an http request.

For your video at http://blip.tv/file/3627639

In Google Chrome you can inspect network requests (ctrl + shift + i) look for the longest to finish in your case :

Fosslc-..
/file/get

click on it and copy/paste url from 'Request URL' field, to a new tab

http://blip.tv/file/get/Fosslc-2...to823.flv?showplayer=20110401114509&source=1

3
  • Fantastic! I'm tempted to accept your answer since it actually worked for me, but I'll wait a bit longer to see if any other answers actually address locating the downloaded flv.
    – xyzzyrz
    Apr 8, 2011 at 3:24
  • please don't accept it, since it's just a trick for your case. I really want to know where the hell flash store temporary video files.
    – Doud
    Apr 10, 2011 at 8:49
  • Heh, all right. I do want to know as well. My hunch is that it's getting stored somewhere in the data_* files, which are probably browser-specific heaps. I couldn't find any tool to rummage through them, though, short of diving into the Chrome code base.
    – xyzzyrz
    Apr 13, 2011 at 20:47
9

Yang,

Yeah, it's in ~/.cache/google-chrome/Cache (well, I have Chromium installed so I found it in ~/.cache/chromium/Cache).

If you watch the video and sort by time stamp:

$ ls -rt | tail
f_00003a
f_00003b
f_00003c
f_00003d
data_2
data_3
index
data_1
f_000040
data_0

Then if you run the file command you'll see which ones are Flash:

$ file $(ls -rt | tail)
f_00003a: Macromedia Flash data (compressed), version 9
f_00003b: Macromedia Flash data (compressed), version 9
f_00003c: Macromedia Flash data (compressed), version 10
f_00003d: PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
data_2:   data
data_3:   data
index:    data
data_1:   data
f_000040: Macromedia Flash Video
data_0:   data

OK, I installed Google Chrome to check it out.

Looks like the directory for Google Chrome is slightly different from Chromium.

Using the same techniques (here specifying the process ID of the browser, output removed some columns for clarity):

$ lsof -p 27922 | grep Cache
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/index
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_3
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_2
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_1
chrome  27922 mem     ~/.cache/google-chrome/Default/Cache/data_0
chrome  27922  71u    ~/.cache/google-chrome/Default/Cache/index
chrome  27922  72u    ~/.cache/google-chrome/Default/Cache/data_0
chrome  27922  73u    ~/.cache/google-chrome/Default/Cache/data_1
chrome  27922  74u    ~/.cache/google-chrome/Default/Cache/data_2
chrome  27922  75u    ~/.cache/google-chrome/Default/Cache/data_3
chrome  27922 111u    ~/.cache/google-chrome/Default/Cache/f_00001a
4
  • That's intriguing, because it doesn't work for me. I updated my answer with a paste of what I see. Does it work for you with the example blip.tv URL I gave? Maybe it's because of a different version of Chrome - which are you using?
    – xyzzyrz
    Feb 8, 2011 at 8:17
  • Yeah I used your exact URL. Were you playing the file while running the commands? Try clearing your cache, playing the file and then run the commands. It worked for me and I could play the file in Mplayer so it worked for me!
    – jyap
    Feb 8, 2011 at 8:22
  • Alas, clearing the cache didn't help. Yes, the file was playing while I was running these commands. Updated my answer with more information. Some answerers say I should be looking at the Flash process, others say I should look at one of the browser processes, but I've tried both, even looking at all processes. Any ideas on why it's broken for me? I've tried on several machines now.
    – xyzzyrz
    Feb 16, 2011 at 22:04
  • I edited my answer above to specify the process ID of Google Chrome and running the lsof command. Try that out.
    – jyap
    Feb 19, 2011 at 10:35
5

using chromium 11.0.666.0, and flash plug-in 10.2.152

grepping for npviewer did not produce any flash process for me but grepping for flash does:

$ ps x | grep flash
11005 ?        Rl     2:30 /usr/lib/chromium-browser/chromium-browser ... 

basically same thing as jyap above suggested with

lsof | grep Flash

and you can then proceed as above...

1
  • This doesn't work for me - I updated my answer with details of what I see. Do you know why it might not be working for me? I tried on several machines now.
    – xyzzyrz
    Feb 16, 2011 at 22:06
3

Try listing out the open files.

lsof | grep Flash
1
  • Did this work for you? Doesn't turn up anything for me - I wouldn't guess that it would either, given that the typical Flash* files aren't showing up in their usual location.
    – xyzzyrz
    Feb 6, 2011 at 19:34
3

Some of the newer players buffer in memory to try to make it impossible for people to use these tricks. You won't be able to get anything in that case.

1
  • While this is helpful info, and bearing in mind I don't know how to probe RAM (just that it is possible), I don't agree that you "won't be able to get anything". Where there is a will, there is a way.
    – user66001
    Sep 4, 2013 at 16:34
3

I fixed this issue. Here the steps are

  1. Goto installed plugins about:plugins in chrome / mozilla
  2. Click Details to view with more information. Disable the Flash Plugin. The Location of the plugin would be “/usr/lib/adobe-flashplugin/libflashplayer.so”
  3. Download the tar.gz version of flash player from here http://get.adobe.com/flashplayer/
  4. Extract that file and copy the libflashplayer.so to /usr/lib/chromium-browser/plugins . Then Enable this in plugin page.
  5. If you view any video it will download in /home//.cache/chromium/Default/Cache this folder

have a look http://www.arulraj.net/2011/03/google-chrome-download-video.html

2

For the latest Chrome on Linux:

  1. Identify the pid of the Flash plugin used by Chrome:

    ps ax | grep -i chrome | grep -i flash 
    

    as of now the plugin is called libgcflashplayer.

  2. Identify the Flash file opened by this Flash plugin process:

    file /proc/Flash_Plugin_PID/fd/* | grep -i deleted
    

    or

    lsof -p Flash_plugin_pid | grep -i deleted
    

    Look for deleted files.

  3. Copy the file from /proc/[pid]/fd/[fileno] to recovered_file.flv

2

I'm using chrome 11.06 on Ubuntu 10.04. I found my flv files in ~/.cache/google-chrome/Default/Cache. Try a

file * | grep Flash\ Video
2

A little tip from me. This works in Ubuntu 10.04.

#!/bin/bash
viewer=`ps x|grep npviewer|grep -v grep |awk '{print $1}'`
echo $viewer
cd /proc/${viewer}/fd
jef=(`ls -l|awk '{print $8 " " $10}'|grep Flash|awk '{print $1}'`)
echo $jef
jef1=${#jef}
ext=`date +'%d_%m_%k_%M_%S'`
i=0
while [ "$i" -lt "$jef1" ]
do 
cp ${jef[${i}]} /fun/${jef[${i}]}"(${ext})".flv
i=`expr $i + 1`
done

Now you can schedule this script with the crontab. It could be optimized so that there are no duplicate FLV files.

2

Using Firefox on Kubuntu:

export COUNT=0
export FILENAME=$1
export FILENAME=${FILENAME:=test}

PID=`ps ax | grep -i flashplugi[n] | awk '{print $1}'`
FLASH=`ls -l /proc/$PID/fd| grep Flash | awk '{print $8}'`

for N in $FLASH ; do
  COUNT=$(($COUNT+1))
  cp /proc/$PID/fd/$N ${FILENAME}_${COUNT}.flv
done
0

I have another way to do it based on the file descriptor founded in /proc (I use modern bash in a few lines)

#!/bin/bash

process="flash"
filename="flash"

readlink -f /proc/$$/exe | fgrep -q bash || {
    echo >&2 "Hey dude ! You must call $0 with bash !"
    exit 2
}

. ~/.bashrc || . /etc/profile

count=1
for pid in $(pgrep -f $process); do
    fds=$(file /proc/$pid/fd/[0-9]* | fgrep Flash | cut -d: -f1)
    for fd in $fds; do
        cp -v $fd ${filename}_${count}.flv
        ((count++))
    done
done

# vim:ts=4:sw=4

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .