title: Linux: Use File descriptor to find flash stream
body: <p>First of all I want to declare, that I do not intend to do any illegal actions concerning copyright protected streams and videos. I think I have the right to know, what a process running on my computer is doing (and which files and locations are involved) and therefore I ask the question. I know that that knowledge may be abused by people, but that is more a general problem of knowledge and technology and therefore no valid argument for not answering this question in public.</p>
  
  <p>I am using latest google-chrome browser (with the integrated pepperflash), but I have seen that my problem is the same for firefox with a locally installed flash plugin. (Version 11.2 and higher).<br>
  In the past flash content was stored in /tmp and one could easily see the files involved. 
  Later the process was changed, so that these files were not visible without using lsof.
  Using the command </p>
  
  <pre><code>lsof | grep Flash
  </code></pre>
  
  <p>showed sth. like </p>
  
  <pre><code>plugin-co 1347 user 16w REG 8,2 10221034 265226 /tmp/FlashXXv6onXK (deleted)
  </code></pre>
  
  <p>in the case of firefox. So you could still access and see the flash files involved. 
  Now this is not possible anymore. In the case of chrome </p>
  
  <pre><code>lsof | grep lash 
  </code></pre>
  
  <p>gives me </p>
  
  <pre><code>chrome    2705            user  mem       REG               8,18 17015392    401558 /opt/google/chrome/PepperFlash/libpepflashplayer.so
  </code></pre>
  
  <p>which does not give me any files. 
  So i thought, maybe searching for deleted files, concerning chrome gives me some results:</p>
  
  <pre><code>lsof | grep hrome | grep deleted
  </code></pre>
  
  <p>but it is not possible to see anything useful from the output. (at least for me). Using the PID and file descriptors to access files only gives me files of a few kilobytes (which is by far not the size of a loaded file). Trying to playback the recovered files (only for test purposes) did not work. </p>
  
  <p>Another interesting thing to note I have found out about:
  Normally streaming bigger videos meant there were several hundred megabytes less space on my drive until I closed google chrome. So I moved the following directories to a tmpfs:</p>
  
  <pre><code>/home/user/.cache/google-chrome
  /home/user/.config/google-chrome/PepperFlash/
  /home/user/.config/google-chrome/Default/Pepper Data/
  </code></pre>
  
  <p>which does not allocate space on my drive anymore while playing back big streams. So I guess these directories host these files. However I was not successful to find any delted files in these directories using lsof or any other method. </p>
  
  <p>I would be very thankful if somebody could tell me where the files are stored and how to find out about individual video files and how to access them. Are they split up in parts somehow now? </p>
  
  <p>Thank you very much!</p>