Thanks for the clarification...there are many numbers in the printout and your explanation clears the scene....
]]>for file in $(lsof -n|cut -b 77-|grep -i \/cache\/|grep -v 'fontconfig\|deleted'|sort --uniq); do file $file;done|grep 'Video'|MPEG'
Tested with chromium, firefox and opera.
I explicitely removed "deleted" files from the list because if no process has that file open, then the "proc" trick isn't useful, i think.
a way to keep that stream open is to do "tail -f stream >/dev/null"; in that way you can still access the file via /proc.
Lymphotik: lsof is installed.
Cannot find and proc process in my x86_64 system.
Perhaps it is only i686?
root@n6re ~]# lsof |grep deleted plugin-co 1190 root 16w REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted) plugin-co 1190 1191 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted) [root@n6re ~]#
What might I do next?
Well it is pretty straight forward once you have this. The fisrt number is your pid (1190) and the file is called 16 in your case. it could be another number. You just have to look at the number before REG.
Then if you want to watch it
mplayer /proc/1190/fd/16
or to copy just use cp.
But all this is explained http://www.linux.com/archive/articles/58142.
]]>So cache is actually done on /tmp/, but flash marks the file as deleted, so only the flash process knows it exists
Eh... doesn't this mean that it could get overwritten anytime by another process?
edit: Can you disable that it gets marked as deleted?
]]>Result of the search gives the following:
[root@n6re proc]# cd /proc/1952/fd/
[root@n6re fd]# ls -l
total 0
lr-x------ 1 root root 64 Dec 2 10:59 0 -> pipe:[6110]
l-wx------ 1 root root 64 Dec 2 10:59 1 -> /root/.xsession-errors
lr-x------ 1 root root 64 Dec 2 10:59 10 -> pipe:[9194]
l-wx------ 1 root root 64 Dec 2 10:59 11 -> pipe:[9195]
lr-x------ 1 root root 64 Dec 2 10:59 12 -> pipe:[9195]
l-wx------ 1 root root 64 Dec 2 10:59 13 -> socket:[9196]
lrwx------ 1 root root 64 Dec 2 10:59 14 -> /root/.mozilla/firefox/5f9228j3.default/cert8.db
lr-x------ 1 root root 64 Dec 2 10:59 15 -> /root/.mozilla/firefox/5f9228j3.default/key3.db
l-wx------ 1 root root 64 Dec 2 10:59 16 -> /tmp/FlashXXQBDno3 (deleted)
lr-x------ 1 root root 64 Dec 2 10:59 17 -> /dev/snd/timer
lr-x------ 1 root root 64 Dec 2 10:59 18 -> /dev/snd/pcmC0D0p
lr-x------ 1 root root 64 Dec 2 10:59 19 -> /dev/snd/controlC0
l-wx------ 1 root root 64 Dec 2 10:59 2 -> /root/.xsession-errors
lrwx------ 1 root root 64 Dec 2 10:59 3 -> socket:[9111]
lr-x------ 1 root root 64 Dec 2 10:59 4 -> anon_inode:[eventpoll]
l-wx------ 1 root root 64 Dec 2 10:59 5 -> socket:[9191]
l-wx------ 1 root root 64 Dec 2 10:59 6 -> socket:[9192]
lrwx------ 1 root root 64 Dec 2 10:59 7 -> pipe:[9193]
lrwx------ 1 root root 64 Dec 2 10:59 8 -> pipe:[9193]
lrwx------ 1 root root 64 Dec 2 10:59 9 -> pipe:[9194]
[root@n6re fd]#
What number is to be utilized for connecting to the deleted file?
]]>#2 Go to
/proc/$(pid of flash process)/fd/
#3 Do a directory listing and search for files marked as deleted
'ls -l'
The file should be a number linking to something like /tmp/Flash* (deleted)
So cache is actually done on /tmp/, but flash marks the file as deleted, so only the flash process knows it exists
Cannot find and proc process in my x86_64 system.
Perhaps it is only i686?
root@n6re ~]# lsof |grep deleted
plugin-co 1190 root 16w REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1191 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1200 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1201 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1202 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1204 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1205 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1363 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1427 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
plugin-co 1190 1429 root 16u REG 8,19 106783447 294884 /tmp/FlashXXPj7I74 (deleted)
[root@n6re ~]#
What might I do next?
]]>lsof | grep deleted
Then I could use the pid from lsof and the number as explained in the link to mplayer the file.
]]>aur/flashplugin-prerelease 10.2.161.23-1
]]>Solved it! The files can be found in the folder:
/dev/shm/firefox-cache/Cache
Which version of flash do you use? Because I do not have this directory
]]>/dev/shm/firefox-cache/Cache