Linux – In Google Chrome on Linux, where is the flv if not in /tmp

flashgoogle-chromelinuxUbuntuvideo

I like to keep videos because

  1. I like buffering them and then playing them back-to-back in my media player,
  2. I want to be able to stop/restart my browser without losing all the buffered video, and
  3. Flash frequently crashes and gives me the gray boxes.

For many sites with Flash video (including Youtube), I can find the flv file in /tmp, usually named FlashXX.... But some sites manage to prevent this file from showing up, e.g. http://blip.tv/file/3627639. It's possible this isn't spooled to disk at all, but that would be surprising since the entire hour-long video can be buffered without my RAM being noticeably impacted.

In Firefox, I can find the flv inside its cache directory. But I'm curious how to do this in Chrome. I tried looking under ~/.cache/google-chrome/ but didn't find anything that looked right. For instance:

$ ls -lt .cache/google-chrome/Cache/ | head
total 261492
-rw------- 1 yang yang 16621568 2010-12-05 03:41 data_1
-rw------- 1 yang yang   966656 2010-12-05 03:40 data_0
-rw------- 1 yang yang 23076864 2010-12-05 03:40 data_2
-rw------- 1 yang yang   262512 2010-12-05 03:40 index
-rw------- 1 yang yang   108412 2010-12-05 03:35 f_005603
-rw------- 1 yang yang    62607 2010-12-05 03:32 f_005602
-rw------- 1 yang yang    54998 2010-12-05 03:32 f_005601
-rw------- 1 yang yang    31127 2010-12-05 03:32 f_005600
-rw------- 1 yang yang   799389 2010-12-05 03:32 f_0055ff

$ ls -1t ~/.cache/google-chrome/Cache/* | head | xargs file
/home/yang/.cache/google-chrome/Cache/data_1:   data
/home/yang/.cache/google-chrome/Cache/data_0:   data
/home/yang/.cache/google-chrome/Cache/data_2:   data
/home/yang/.cache/google-chrome/Cache/index:    data
/home/yang/.cache/google-chrome/Cache/f_005603: GIF image data, version 89a, 600 x 471
/home/yang/.cache/google-chrome/Cache/f_005602: PNG image, 600 x 746, 8-bit colormap, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005601: PNG image, 140 x 342, 8-bit/color RGB, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005600: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055ff: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055fe: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)

I tried looking at the open files for the Flash process, but didn't see any deleted Flash files, which a bunch of the answers below say should exist:

$ ps x | grep npviewer
27148 ?        Rl     0:24 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin --plugin /usr/lib/flashplugin-installer/libflashplayer.so --connection /org/wrapper/NSPlugins/libflashplayer.so/27135-2
27504 pts/2    S+     0:00 grep --color=auto npviewer

$ ls -l /proc/27148/fd/
total 0
lr-x------ 1 yang yang 64 2011-02-16 13:48 0 -> /dev/null
lrwx------ 1 yang yang 64 2011-02-16 13:48 1 -> /home/yang/.xsession-errors
l-wx------ 1 yang yang 64 2011-02-16 13:48 10 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/key3.db
lrwx------ 1 yang yang 64 2011-02-16 13:48 11 -> pipe:[5500575]
lrwx------ 1 yang yang 64 2011-02-16 13:48 12 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 13 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 14 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 15 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 16 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 17 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 18 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 19 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 2 -> /home/yang/.xsession-errors
lrwx------ 1 yang yang 64 2011-02-16 13:48 20 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 21 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 22 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 23 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 24 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 25 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 26 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 27 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 28 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 29 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 3 -> socket:[5496032]
lrwx------ 1 yang yang 64 2011-02-16 13:51 30 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 31 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 32 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 33 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 34 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 35 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:53 36 -> pipe:[5500575]
lr-x------ 1 yang yang 64 2011-02-16 13:53 37 -> pipe:[5500576]
l-wx------ 1 yang yang 64 2011-02-16 13:53 38 -> pipe:[5500576]
lrwx------ 1 yang yang 64 2011-02-16 13:53 39 -> socket:[5500580]
lrwx------ 1 yang yang 64 2011-02-16 13:48 4 -> socket:[5496131]
lr-x------ 1 yang yang 64 2011-02-16 13:48 5 -> pipe:[5496139]
l-wx------ 1 yang yang 64 2011-02-16 13:48 6 -> pipe:[5496139]
lr-x------ 1 yang yang 64 2011-02-16 13:48 7 -> socket:[5496140]
l-wx------ 1 yang yang 64 2011-02-16 13:48 8 -> socket:[5496141]
lr-x------ 1 yang yang 64 2011-02-16 13:48 9 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/cert8.db

I tried straceing all the chrome processes for anything that looked like it might be writing a file:

strace -p (pgrep chrome|xargs -I_ echo -p _)

but looking at the write/writev/select calls only pointed me to a few FDs that /proc/_/fd/ showed to be pipes/sockets (presumably for the processes to talk to each other). Also tried the same thing on the npviewer.bin process.

I also tried to simply inspect all the files pointed to in /proc/*/fd/ (any processes) that were recently modified, but didn't find anything that looked like it contained a flv. I also tried the same check on the recently modified files under ~/.cache/google-chrome/.

If it makes a difference, I'm using the dev channel release of Chrome, which I believe (always?) uses its own secure Flash implementation. At the moment of this update, I'm using Chrome 10.0.648.45 dev. According to http://www.adobe.com/software/flash/about/ I'm running 10.2.152.27. I've tried on several Ubuntu boxes now. I've also tried on several Ubuntu boxes now, with the same results.

Any others want to take a stab at this?

Best Answer

I observed that the recent Flash plugins do store files in /tmp, but they use a trick of removing them and keeping a filehandle open to keep them alive. This means they are still kept on the drive (as long as the filehandle is opened by flash plugin), but they are not visible in directory listing (because the file has been deleted).

I wrote about this some time age: getting flash videos from almost deleted files

But it all depends on version of Flash plugin. It used to store movies in /tmp or in browser's cache too.