Recover tmp flash videos (deleted immediately by the browser plugin)

for h in `find /proc/*/fd -ilname "/tmp/Flash*" 2>/dev/null`; do ln -s "$h" `readlink "$h" | cut -d' ' -f1`; done
Newer versions of the flashplayer browser plugin delete the tmp flash video immediately after opening a filehandle to prevent the user from "exporting" the video by simply copying the /tmp/FlashXYZ file. This command searches such deleted flash videos and creates symbolic links to the opened filehandle with the same name as the deleted file. This allows you to play your flash-videos (from e.g. youtube) with e.g. mplayer or copy the buffered video if you want to keep it.
Sample Output
ls /tmp/Flash*

17
By: hons
2011-03-02 09:43:42

1 Alternatives + Submit Alt

  • Certain Flash video players (e.g. Youtube) write their video streams to disk in /tmp/ , but the files are unlinked. i.e. the player creates the file and then immediately deletes the filename (unlinking files in this way makes it hard to find them, and/or ensures their cleanup if the browser or plugin should crash etc.) But as long as the flash plugin's process runs, a file descriptor remains in its /proc/ hierarchy, from which we (and the player) still have access to the file. The method above worked nicely for me when I had 50 tabs open with Youtube videos and didn't want to have to re-download them all with some tool.


    8
    lsof -n -P|grep FlashXX|awk '{ print "/proc/" $2 "/fd/" substr($4, 1, length($4)-1) }'|while read f;do newname=$(exiftool -FileModifyDate -FileType -t -d %Y%m%d%H%M%S $f|cut -f2|tr '\n' '.'|sed 's/\.$//');echo "$f -> $newname";cp $f ~/Vids/$newname;done
    mhs · 2012-02-25 01:49:45 1

What Others Think

Simple idea, yet so powerful!!! Basically, the fact of using the /proc filesystem for recovering deleted files is the point. The rest of the stuff, I find it a bit of sugar around a beautiful idea...
xakon · 380 weeks and 5 days ago
Very slick :)
linuxrawkstar · 380 weeks and 4 days ago
WONDERFUL! This is just great.. thanks a lot
brausen · 367 weeks and 2 days ago
I agree with xakon; this is good for a lot more than youtube videos -- I've always wondered if there was a way to access deleted inodes while a process still had them open, now I know :) BTW, the lsof command can be useful for finding out which process has a file open, e.g. lsof | grep Flash does much the same thing as that find command.
thetrivialstuff · 366 weeks and 5 days ago

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands



Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: