Filesystem – Why macOS Doesn’t Have /proc Directory Explained

lsof will show you the open file handles.

If you know the PID use the -p flag.

Eg, on my zsh shell at the moment I see:

alex@smiley:~|⇒  lsof -p 82946
COMMAND   PID USER   FD   TYPE DEVICE  SIZE/OFF     NODE NAME
zsh     82946 alex  cwd    DIR  14,12      2414   186278 /Users/alex
zsh     82946 alex  txt    REG  14,12   1103984       73 /bin/zsh
zsh     82946 alex  txt    REG  14,12    474672   787843 /usr/lib/zsh/4.3.11/zsh/zle.so
zsh     82946 alex  txt    REG  14,12    258672   787864 /usr/lib/zsh/4.3.11/zsh/complete.so
zsh     82946 alex  txt    REG  14,12    120576   787863 /usr/lib/zsh/4.3.11/zsh/complist.so
zsh     82946 alex  txt    REG  14,12     71264   787838 /usr/lib/zsh/4.3.11/zsh/zutil.so
zsh     82946 alex  txt    REG  14,12     79968   787852 /usr/lib/zsh/4.3.11/zsh/parameter.so
zsh     82946 alex  txt    REG  14,12    599280  7719861 /usr/lib/dyld
zsh     82946 alex  txt    REG  14,12 296980480 12427083 /private/var/db/dyld/dyld_shared_cache_x86_64
zsh     82946 alex    0u   CHR   16,0   0t26354     6285 /dev/ttys000
zsh     82946 alex    1u   CHR   16,0   0t26354     6285 /dev/ttys000
zsh     82946 alex    2u   CHR   16,0   0t26354     6285 /dev/ttys000
zsh     82946 alex   10u   CHR   16,0    0t3432     6285 /dev/ttys000

The Type column shows the various file or pseudo file types that might be open, sockets, pipes, etc.

ulimit or limit, depending on system and shell lets you change the number of open files.

/proc has never been included in any version of OS X (although Amit Singh wrote a version of procfs for OS X). You should, however, be able to get at it through /.vol instead. First, find the device number for the volume it lives on with something like stat -f%d /Users/lamnk (assuming you don't have your Library weirdly redirected to another volume). Then get its file ID (aka inode number) from the lsof command (370617680 in the example you gave). You can then reach it as /.vol/volumeid/fileid:

$ stat -f%d /Users/lamnk
234821716
$ lsof -c "Google Chrome" | grep "Pepper Data"
Google 38571 lamnk 74u REG 1,2 156826302 37061768 /Users/lamnk/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/.com.google.Chrome.KNc63e
$ cp /.vol/234821716/37061768 rawfile

EDIT: Apparently /.vol does not find unlinked-but-open files, even though they still exist on disk. Unfortunately, this means this trick won't work here. You might be able to do it with Amit Singh's procfs, but I haven't used it so I don't know if it'll do the trick either.