Linux – In Google Chrome on Linux, where is the flv if not in /tmp

I like to keep videos because

1. I like buffering them and then playing them back-to-back in my media player,
2. I want to be able to stop/restart my browser without losing all the buffered video, and
3. Flash frequently crashes and gives me the gray boxes.

For many sites with Flash video (including Youtube), I can find the flv file in /tmp, usually named FlashXX.... But some sites manage to prevent this file from showing up, e.g. http://blip.tv/file/3627639. It's possible this isn't spooled to disk at all, but that would be surprising since the entire hour-long video can be buffered without my RAM being noticeably impacted.

In Firefox, I can find the flv inside its cache directory. But I'm curious how to do this in Chrome. I tried looking under ~/.cache/google-chrome/ but didn't find anything that looked right. For instance:

$ ls -lt .cache/google-chrome/Cache/ | head
total 261492
-rw------- 1 yang yang 16621568 2010-12-05 03:41 data_1
-rw------- 1 yang yang   966656 2010-12-05 03:40 data_0
-rw------- 1 yang yang 23076864 2010-12-05 03:40 data_2
-rw------- 1 yang yang   262512 2010-12-05 03:40 index
-rw------- 1 yang yang   108412 2010-12-05 03:35 f_005603
-rw------- 1 yang yang    62607 2010-12-05 03:32 f_005602
-rw------- 1 yang yang    54998 2010-12-05 03:32 f_005601
-rw------- 1 yang yang    31127 2010-12-05 03:32 f_005600
-rw------- 1 yang yang   799389 2010-12-05 03:32 f_0055ff

$ ls -1t ~/.cache/google-chrome/Cache/* | head | xargs file
/home/yang/.cache/google-chrome/Cache/data_1:   data
/home/yang/.cache/google-chrome/Cache/data_0:   data
/home/yang/.cache/google-chrome/Cache/data_2:   data
/home/yang/.cache/google-chrome/Cache/index:    data
/home/yang/.cache/google-chrome/Cache/f_005603: GIF image data, version 89a, 600 x 471
/home/yang/.cache/google-chrome/Cache/f_005602: PNG image, 600 x 746, 8-bit colormap, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005601: PNG image, 140 x 342, 8-bit/color RGB, non-interlaced
/home/yang/.cache/google-chrome/Cache/f_005600: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055ff: JPEG image data, JFIF standard 1.02
/home/yang/.cache/google-chrome/Cache/f_0055fe: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)

I tried looking at the open files for the Flash process, but didn't see any deleted Flash files, which a bunch of the answers below say should exist:

$ ps x | grep npviewer
27148 ?        Rl     0:24 /usr/lib/nspluginwrapper/i386/linux/npviewer.bin --plugin /usr/lib/flashplugin-installer/libflashplayer.so --connection /org/wrapper/NSPlugins/libflashplayer.so/27135-2
27504 pts/2    S+     0:00 grep --color=auto npviewer

$ ls -l /proc/27148/fd/
total 0
lr-x------ 1 yang yang 64 2011-02-16 13:48 0 -> /dev/null
lrwx------ 1 yang yang 64 2011-02-16 13:48 1 -> /home/yang/.xsession-errors
l-wx------ 1 yang yang 64 2011-02-16 13:48 10 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/key3.db
lrwx------ 1 yang yang 64 2011-02-16 13:48 11 -> pipe:[5500575]
lrwx------ 1 yang yang 64 2011-02-16 13:48 12 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 13 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 14 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 15 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 16 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 17 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 18 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:48 19 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 2 -> /home/yang/.xsession-errors
lrwx------ 1 yang yang 64 2011-02-16 13:48 20 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lr-x------ 1 yang yang 64 2011-02-16 13:48 21 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 22 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 23 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 24 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 25 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 26 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 27 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 28 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 29 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:48 3 -> socket:[5496032]
lrwx------ 1 yang yang 64 2011-02-16 13:51 30 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 31 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 32 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 33 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 34 -> /home/yang/.adobe/Flash_Player/cert8.db (deleted)
lrwx------ 1 yang yang 64 2011-02-16 13:51 35 -> /home/yang/.adobe/Flash_Player/key3.db (deleted)
l-wx------ 1 yang yang 64 2011-02-16 13:53 36 -> pipe:[5500575]
lr-x------ 1 yang yang 64 2011-02-16 13:53 37 -> pipe:[5500576]
l-wx------ 1 yang yang 64 2011-02-16 13:53 38 -> pipe:[5500576]
lrwx------ 1 yang yang 64 2011-02-16 13:53 39 -> socket:[5500580]
lrwx------ 1 yang yang 64 2011-02-16 13:48 4 -> socket:[5496131]
lr-x------ 1 yang yang 64 2011-02-16 13:48 5 -> pipe:[5496139]
l-wx------ 1 yang yang 64 2011-02-16 13:48 6 -> pipe:[5496139]
lr-x------ 1 yang yang 64 2011-02-16 13:48 7 -> socket:[5496140]
l-wx------ 1 yang yang 64 2011-02-16 13:48 8 -> socket:[5496141]
lr-x------ 1 yang yang 64 2011-02-16 13:48 9 -> /home/yang/.mozilla/firefox/8wy5j0z2.default/cert8.db

I tried straceing all the chrome processes for anything that looked like it might be writing a file:

strace -p (pgrep chrome|xargs -I_ echo -p _)

but looking at the write/writev/select calls only pointed me to a few FDs that /proc/_/fd/ showed to be pipes/sockets (presumably for the processes to talk to each other). Also tried the same thing on the npviewer.bin process.

I also tried to simply inspect all the files pointed to in /proc/*/fd/ (any processes) that were recently modified, but didn't find anything that looked like it contained a flv. I also tried the same check on the recently modified files under ~/.cache/google-chrome/.

If it makes a difference, I'm using the dev channel release of Chrome, which I believe (always?) uses its own secure Flash implementation. At the moment of this update, I'm using Chrome 10.0.648.45 dev. According to http://www.adobe.com/software/flash/about/ I'm running 10.2.152.27. I've tried on several Ubuntu boxes now. I've also tried on several Ubuntu boxes now, with the same results.

Any others want to take a stab at this?