Finding a Flash video in chrome – Saving files open but deleted

Flash movies are online, but sometimes i want to save some for offline usage so i can watch them later or offline (laptops) etc.
Often there is no way to save/download these files, but they are not held in the tmp dir or cache as they used to be due to changes in flash. In Linux this is easy to overcome using the following methods. This also works for any file that’s been deleted but is still running in memory.

First, you need to find what or where the file is. For flash try

velofille@apple:~$ sudo lsof |grep Flash
npviewer.  8774  velofille   16u      REG                9,1 253092771     396153 /tmp/FlashXXDfgiS7 (deleted)
velofille@apple:~$ 

Bingo, i found my file! Of course the file /tmp/FlashXXDfgiS7 is deleted, so i cant just copy it like the good old days. Now i can copy that file from the proc filesystem using the following

cat /proc/8774/fd/16 > movie.flv

Now to breakdown where i got those parms from. The 8774 is the pid and 2nd number on the line, the 16 was from the ’16u’ which is the file descriptor . So when you do your lsof you can change those according to what you have open.
To find files open from a particular app, use ps to find the pid, then use

lsof -p 8774

Output is something like this

chrome  26572 velofille  mem    REG                9,1  1285536   1836431 /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0
chrome  26572 velofille  mem    REG                9,1   141088   3146088 /lib/x86_64-linux-gnu/ld-2.13.so
chrome  26572 velofille  DEL    REG               0,16           34257353 /dev/shm/.com.google.chrome.i96CPN
chrome  26572 velofille  DEL    REG               0,16           34257687 /dev/shm/.com.google.chrome.W9M2O5
chrome  26572 velofille  mem    REG                9,1   377352   4587538 /opt/google/chrome/libppGoogleNaClPluginChrome.so
chrome  26572 velofille    0r   CHR                1,3      0t0      5778 /dev/null
chrome  26572 velofille    1u   REG               0,20   953173   5767170 /home/velofille/.xsession-errors
chrome  26572 velofille    2u   REG               0,20   953173   5767170 /home/velofille/.xsession-errors
chrome  26572 velofille    3u   REG               0,20   953173   5767170 /home/velofille/.xsession-errors
chrome  26572 velofille    4r  FIFO                0,8      0t0  34257284 pipe
chrome  26572 velofille    5u  unix 0xffff88002c61f740      0t0  34257940 socket
chrome  26572 velofille    6u  sock                0,7      0t0  34257281 can't identify protocol
chrome  26572 velofille    7u   CHR                1,9      0t0      5783 /dev/urandom

The only ones you can take like this are the ones with a file descriptor to play with.

Good luck, an have fun!