So you’ve just watched a movie, you like it and want a backup copy of it. You’ve looked in your browser’s cache directory and you’ve looked in your computer’s tmp directory but you just can’t find the flash file for the video; and you won’t find it because Flash deletes the file then reads and writes the deleted file using it’s file descriptor.
Whatever you do, do not close the browser tab that your video is playing in.
The following instructions apply to Linux. The example below shows how to copy a Flash (flv) file that’s been played in Google’s Chrome browser. Details for doing this with Firefox follow the Chrome example.
I will show you two different ways to do this. The first way is longer but more accurately locates the correct file.
Copy a Flash Movie From Your Browser: Method 1
Find the browser’s process ID (PID)
Copy ‘n’ paste this into a terminal:
top | grep -i chrom
The terminal will list all running processes that contain the phrase “chrom”. The “top” command lists the processes and the “grep” command scans each line returned by “top” for “chrom”. The “-i” switch makes the search case insensitive.
You will see something like this repeating on your screen:
4106 user 20 0 414m 67m 32m S 23 1.7 1:55.51 chromium-browse 4159 user 20 0 179m 47m 25m S 4 1.2 0:14.88 chromium-browse 4324 user 20 0 166m 32m 17m S 0 0.8 0:01.03 chromium-browse 4106 user 20 0 414m 67m 32m S 23 1.7 1:56.19 chromium-browse
Top will keep listing processes until you press “Ctrl+C” to stop it running. The first column in each line shows a number. That number is the ID of the running process i.e it’s PID. When “top” begins repeating the same PIDs, press Ctrl+C to stop “top”.
An application’s process ID changes each time the application is restarted so if you were to run top, close Chrome then restart Chrome, those PIDs would change. Chrome spawns a separate process for each open tab. So this will be easier the fewer tabs you have open.
Use the PID to Locate the File Descriptor (FD)
Modify this next command to scan for file names containing “flashx” opened by each PID used by Chrome:
lsof -p [PID] | grep -i flashx
“lsof -a” lists all open files and “grep -i flashx” scans each line returned by lsof for the text “flashx”.
Using the example results shown for “top | grep -i chrom”, here is how I would use lsof:
First I would try
lsof -p 4106 | grep -i flashx
Then I would try
lsof -p 4159 | grep -i flashx
Lastly I would try
lsof -p 4324 | grep -i flashx
A scan of the correct PID will return a result similar to:
chromium- 4324 user 38u REG 8,1 2861013 917572 /tmp/FlashXXxnqe2F (deleted)
Notice the second column lists the process ID that has opened the file “FlashXXxnqe2F”. That file is marked as deleted.
The File Descriptor (FD) is in the fourth column, just after the username. In the above example it is listed as “38u”. The letter shows whether the file is open for read access (r), write access (w) or read and write access (u). Ignore the letter.
Copy the File to Your Desktop
Because the actual file has been deleted and is only accessible through its file descriptor, it’s not possible to just copy “FlashXXxnque2F”, for example. We need to revive the file through its file descriptor. For instance, we would copy it with
cp /proc/[PID]/fd/[HANDLE] ~/Desktop/movie.flv
Using the above example, I would copy the deleted Flash file with
cp /proc/4324/fd/38 ~/Desktop/movie.flv
I’m now able to play the file in VLC or some other suitable media player.
Applying This to Firefox
The only bit to change is the “top” command.
Where we use “top | grep -i chrom” for Chrome, for Firefox we use
top | grep -i plugin-containe
Copy a Flash Movie From Your Browser: Method 2
This method is less accurate but much quicker and requires less mental memory work but it’s not suitable when lots of different instances of Flash are being run unless you can guess the file from its size.
Instead of finding the process ID, just look for any open file that contains “flash” in it:
lsof | grep -i flash
That command may take a minute or two to run and will provide results similar to
firefox 3252 user mem REG 8,1 12537796 2228855 /usr/lib/mozilla/plugins/libflashplayer.so chromium- 4287 user mem REG 8,1 17040824 1234333 /usr/lib/flashplugin-installer/libflashplayer.so chromium- 4287 user 38u REG 8,1 89433082 917572 /tmp/FlashXXxnqe2F (deleted)
The file you want is the one that ends in (deleted).
If you use a version of grep that allows regular expressions, use this command:
lsof | grep -i -r "flash.*deleted"
Now copy it, as before, using
cp /proc/[PID]/fd/[HANDLE] ~/Desktop/movie.flv
Exceptions
Not all streamed videos use Flash, YouTube videos included. You’ll need to look in your browser cache to locate the file after it’s streamed or use a browser plugin to download the file. The method outlined above is specific to copying Flash streams after you’ve watched them and decided you would like a copy for later viewing.
