Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I used to find the location of cached flash videos by lsof | grep Flash, the result is something like this

Google 38571 lamnk 74u REG 1,2 156826302 37061768 /Users/lamnk/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/.com.google.Chrome.KNc63e

Pepper flash player deleted the files so you can not see or copy them, but the process 38571 still hold the files open. Normally I can save the cached flash video by copying /proc/38571/fd/74 to another location. However on Mountain Lion I find out that /proc is not there anymore!

Is it possible to get another process to use these file handles and read the files that exist but lack a proper filesystem handle / inode structure? Do I need to configure /proc in 10.8 if the native tools won't work?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

/proc has never been included in any version of OS X (although Amit Singh wrote a version of procfs for OS X). You should, however, be able to get at it through /.vol instead. First, find the device number for the volume it lives on with something like stat -f%d /Users/lamnk (assuming you don't have your Library weirdly redirected to another volume). Then get its file ID (aka inode number) from the lsof command (370617680 in the example you gave). You can then reach it as /.vol/volumeid/fileid:

$ stat -f%d /Users/lamnk
234821716
$ lsof -c "Google Chrome" | grep "Pepper Data"
Google 38571 lamnk 74u REG 1,2 156826302 37061768 /Users/lamnk/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/.com.google.Chrome.KNc63e
$ cp /.vol/234821716/37061768 rawfile

EDIT: Apparently /.vol does not find unlinked-but-open files, even though they still exist on disk. Unfortunately, this means this trick won't work here. You might be able to do it with Amit Singh's procfs, but I haven't used it so I don't know if it'll do the trick either.

share|improve this answer
    
Thanks, but i do not see any volumeid directory inside .vol. .vol is empty. I have a single Volume for everything. –  Lamnk Nov 25 '12 at 9:30
    
/.vol doesn't allow you to list its contents; you need to specify the volume ID and file ID to see anything. –  Gordon Davisson Nov 26 '12 at 0:09
    
I still can not copy the file with path /.vol/volumeid/fileid out. cp says there is no such file. You can see the output here: gist.github.com/4146193 . Thanks! –  Lamnk Nov 26 '12 at 2:01
    
@Lamnk: I experimented a bit, and apparently /.vol won't find unlinked files, even if they're still open (and hence still exist on disk), so it won't work for this. Sorry... –  Gordon Davisson Nov 26 '12 at 5:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.