Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I like copying flash videos for offline viewing later. I used to do this by loading the video in the browser (Firefox or Google Chrome), then running this command to see where the flash file was being cached:

lsof | grep ^Google | grep folders

This will show all the temporary files Google Chrome has open at the moment, for example:

...
Google    311 mike   21u     REG       14,1    262148 17819373 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa
Google    311 mike   22u     REG       14,1      9974 17819369 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.MUo4JT
Google    312 mike  txt      REG       14,1      9974 17819369 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.MUo4JT
Google    312 mike  txt      REG       14,1    262148 17819373 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa
... etc

None of the files exist, though:

$ ls /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa
ls: /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa: No such file or directory

Listing the directory doesn't show any files or directories like this existing:

$ ls -lA /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/
total 0
drwxr-xr-x  3 mike  staff  102 Jul 24 18:14 TemporaryItems
srwxr-xr-x  1 mike  staff    0 Jul 24 12:10 com.apple.notify.206.32
srwxr-xr-x  1 mike  staff    0 Jul 24 12:10 com.apple.notify.206.33
drwxr-xr-x  2 mike  staff   68 Jul 24 18:25 hsperfdata_mike

What's going on here? Why can't I access the temporary files?

Since my goal is to copy the flash file for later viewing, is there anything else I can do?

share|improve this question
add comment

4 Answers

up vote 6 down vote accepted

On some unix variants, lsof shows files that have been deleted but are still open. More precisely, these files have a “link count” of 0, meaning that there is no directory entry (no link, i.e. no name) that leads to them, but the file data still exists. The file data will be deleted when the file is closed.

The ability of lsof to display files with a link count of 0 depends on the platform, and I can't find anything in the documentation regarding the situation on OS X. Try running lsof +L to see the files' link count, or lsof +L1 to list only files with a link count of 0.

I wouldn't be surprised if the flash plugin created the file and immediately deleted in, it's a simple technique for making the data harder to obtain from outside the application. In other words, it's what the plugin author would do precisely to make it hard to do what you're trying to do. If that's what going on, you could counter it with something like libtrash for OSX.

share|improve this answer
    
This appears to be why the files are not visible with ls. Indeed, running lsof +L shows link counts of 0. Thanks for explaining this! –  Mike Mazur Jul 24 '11 at 14:03
1  
Immediately deleting temporary files is also a good way to make sure the files will be removed if the application crashes (or if there is a power failure). –  Ansgar Esztermann May 25 '12 at 14:36
add comment

Have you tried putting the path in quotes?

Like this:

$ ls "/private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa" 
share|improve this answer
    
The quotes don't help. I'll add to the question that listing the directory doesn't show any .com.google.chome.* files or directories. –  Mike Mazur Jul 24 '11 at 10:30
    
I know this isn't answering your question but have you tried something like flv download? bitbucket.org/m.23/flv_download/wiki/Home –  Digitalchild Jul 24 '11 at 10:46
add comment

lsof without sudo may not list all open files

Rule of thumb:

  • to ensure comprehensive results from lsof, use sudo

Example

Run the two commands below. Observe the differences in output. With privileges, expect to find many more lines.

Without superuser privileges

lsof / | grep root

With privileges

sudo lsof / | grep root
share|improve this answer
add comment

Try this:

cp /proc/$pid$/fd/$fdid$

Where:

  • $pid$ - Process id
  • $fdid$ - File descriptor id

Process ids usually are 4 digit numbers. File descriptors usually have a letter next to them (r, u, w, etc.).

Take this one for example:

Google    311 mike   22u     REG       14,1      9974 17819369 /private/var/folders/z...

Replace $pid$ with 311 and $fdid$ with 22 so that you get:

cp /proc/311/fd/22
share|improve this answer
1  
Mac OS X doesn't have the /proc filesystem. –  Mike Mazur May 26 '12 at 5:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.