Linux: How to Move Flash Movies From Your Browser Cache

So you’ve just watched a movie, you like it and want a backup copy of it. You’ve looked in your browser’s cache directory and you’ve looked in your computer’s tmp directory but you just can’t find the flash file for the video; and you won’t find it because Flash deletes the file then reads and writes the deleted file using it’s file descriptor.

Whatever you do, do not close the browser tab that your video is playing in.

The following instructions apply to Linux. The example below shows how to copy a Flash (flv) file that’s been played in Google’s Chrome browser. Details for doing this with Firefox follow the Chrome example.

I will show you two different ways to do this. The first way is longer but more accurately locates the correct file.

Copy a Flash Movie From Your Browser: Method 1

Find the browser’s process ID (PID)

Copy ‘n’ paste this into a terminal:

top | grep -i chrom

The terminal will list all running processes that contain the phrase “chrom”. The “top” command lists the processes and the “grep” command scans each line returned by “top” for “chrom”. The “-i” switch makes the search case insensitive.

You will see something like this repeating on your screen:

 4106 user      20   0  414m  67m  32m S   23  1.7   1:55.51 chromium-browse
 4159 user      20   0  179m  47m  25m S    4  1.2   0:14.88 chromium-browse
 4324 user      20   0  166m  32m  17m S    0  0.8   0:01.03 chromium-browse
 4106 user      20   0  414m  67m  32m S   23  1.7   1:56.19 chromium-browse

Top will keep listing processes until you press “Ctrl+C” to stop it running. The first column in each line shows a number. That number is the ID of the running process i.e it’s PID. When “top” begins repeating the same PIDs, press Ctrl+C to stop “top”.

An application’s process ID changes each time the application is restarted so if you were to run top, close Chrome then restart Chrome, those PIDs would change. Chrome spawns a separate process for each open tab. So this will be easier the fewer tabs you have open.

Use the PID to Locate the File Descriptor (FD)

Modify this next command to scan for file names containing “flashx” opened by each PID used by Chrome:

lsof -p [PID] | grep -i flashx

“lsof -a” lists all open files and “grep -i flashx” scans each line returned by lsof for the text “flashx”.

Using the example results shown for “top | grep -i chrom”, here is how I would use lsof:

First I would try

lsof -p 4106 | grep -i flashx

Then I would try

lsof -p 4159 | grep -i flashx

Lastly I would try

lsof -p 4324 | grep -i flashx

A scan of the correct PID will return a result similar to:

chromium- 4324       user   38u      REG        8,1   2861013  917572 /tmp/FlashXXxnqe2F (deleted)

Notice the second column lists the process ID that has opened the file “FlashXXxnqe2F”. That file is marked as deleted.

The File Descriptor (FD) is in the fourth column, just after the username. In the above example it is listed as “38u”. The letter shows whether the file is open for read access (r), write access (w) or read and write access (u). Ignore the letter.

Copy the File to Your Desktop

Because the actual file has been deleted and is only accessible through its file descriptor, it’s not possible to just copy “FlashXXxnque2F”, for example. We need to revive the file through its file descriptor. For instance, we would copy it with

cp /proc/[PID]/fd/[HANDLE] ~/Desktop/movie.flv

Using the above example, I would copy the deleted Flash file with

cp /proc/4324/fd/38 ~/Desktop/movie.flv

I’m now able to play the file in VLC or some other suitable media player.

Applying This to Firefox

The only bit to change is the “top” command.

Where we use “top | grep -i chrom” for Chrome, for Firefox we use

top | grep -i plugin-containe

Copy a Flash Movie From Your Browser: Method 2

This method is less accurate but much quicker and requires less mental memory work but it’s not suitable when lots of different instances of Flash are being run unless you can guess the file from its size.

Instead of finding the process ID, just look for any open file that contains “flash” in it:

lsof | grep -i flash

That command may take a minute or two to run and will provide results similar to

firefox   3252       user  mem      REG        8,1  12537796 2228855 /usr/lib/mozilla/plugins/
chromium- 4287       user  mem      REG        8,1  17040824 1234333 /usr/lib/flashplugin-installer/
chromium- 4287       user  38u      REG        8,1  89433082  917572 /tmp/FlashXXxnqe2F (deleted)

The file you want is the one that ends in (deleted).

If you use a version of grep that allows regular expressions, use this command:

lsof | grep -i -r "flash.*deleted"

Now copy it, as before, using

cp /proc/[PID]/fd/[HANDLE] ~/Desktop/movie.flv


Not all streamed videos use Flash, YouTube videos included. You’ll need to look in your browser cache to locate the file after it’s streamed or use a browser plugin to download the file. The method outlined above is specific to copying Flash streams after you’ve watched them and decided you would like a copy for later viewing.

Sharing is caring!

Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Inline Feedbacks
View all comments
Would love your thoughts, please comment.x