Command-Line – Understanding Temporary Files Listed by Lsof That Don’t Exist

adobe-flashcommand lineweb-browsing

I like copying flash videos for offline viewing later. I used to do this by loading the video in the browser (Firefox or Google Chrome), then running this command to see where the flash file was being cached:

lsof | grep ^Google | grep folders

This will show all the temporary files Google Chrome has open at the moment, for example:

...
Google    311 mike   21u     REG       14,1    262148 17819373 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa
Google    311 mike   22u     REG       14,1      9974 17819369 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.MUo4JT
Google    312 mike  txt      REG       14,1      9974 17819369 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.MUo4JT
Google    312 mike  txt      REG       14,1    262148 17819373 /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa
... etc

None of the files exist, though:

$ ls /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa
ls: /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/.com.google.chrome.p22bCa: No such file or directory

Listing the directory doesn't show any files or directories like this existing:

$ ls -lA /private/var/folders/zz/zzTLi2haPMrCYxEbpkwFmS+++TI/-Tmp-/
total 0
drwxr-xr-x  3 mike  staff  102 Jul 24 18:14 TemporaryItems
srwxr-xr-x  1 mike  staff    0 Jul 24 12:10 com.apple.notify.206.32
srwxr-xr-x  1 mike  staff    0 Jul 24 12:10 com.apple.notify.206.33
drwxr-xr-x  2 mike  staff   68 Jul 24 18:25 hsperfdata_mike

What's going on here? Why can't I access the temporary files?

Since my goal is to copy the flash file for later viewing, is there anything else I can do?

Best Answer

On some unix variants, lsof shows files that have been deleted but are still open. More precisely, these files have a “link count” of 0, meaning that there is no directory entry (no link, i.e. no name) that leads to them, but the file data still exists. The file data will be deleted when the file is closed.

The ability of lsof to display files with a link count of 0 depends on the platform, and I can't find anything in the documentation regarding the situation on OS X. Try running lsof +L to see the files' link count, or lsof +L1 to list only files with a link count of 0.

I wouldn't be surprised if the flash plugin created the file and immediately deleted in, it's a simple technique for making the data harder to obtain from outside the application. In other words, it's what the plugin author would do precisely to make it hard to do what you're trying to do. If that's what going on, you could counter it with something like libtrash for OSX.

Related Question