Automatically saving Flash 10 video files marked as (deleted)

There was a time when it was easy to save flash videos played in browser to the hard drive on a Linux machine. All the files were visible in /tmp directory. However recently Flash 10 changed this and has deployed more complicated method to obfuscate the location of the flash video cache files.

When trying to recover the flash files from the /tmp directory there are none to be found, but using lsof to list the open files on the OS yields that the files are the same place, but marked as deleted:

tjansson@bohr:~$ lsof | grep Flash
plugin-co 1347 tjansson 16w REG 8,2 10221034 265226 /tmp/FlashXXv6onXK (deleted)

Luckily lsof has provided us with the process ID (PID) of the creator of the flash file and we can use this to find the associated files in the virtual files sytem /proc/. This is a bit technical, but this following script automates this and copies all flash files currently buffered by the browser to the user’s home.

PID=`lsof | grep "/tmp/Flash" | grep "deleted" | head -1 | awk '{print $2}'`
for file in `ls -l /proc/$PID/fd/ | grep "Flash" | awk '{print $9}'`; do
    FILENAME=`ls -l /proc/$PID/fd/$file | awk '{print $11}'`
    DESTNAME="/home/$USERNAME/`basename $FILENAME`.flv"
    echo "Copying $FILENAME to $DESTNAME"
    rsync --append-verify --copy-links --size-only --partial -h --progress /proc/$PID/fd/$file $DESTNAME

So testing the script using the Will Ferrel’s “The Landlord” video. I have save the script above as and running it yields:

tjansson@bohr:~$ ./
Copying /tmp/FlashXXxYgW1n to /home/tjansson/FlashXXxYgW1n.flv
      10.22M 100%  124.57MB/s    0:00:00 (xfer#1, to-check=0/1)
sent 10.22M bytes  received 31 bytes  20.44M bytes/sec
total size is 10.22M  speedup is 1.00

The subject has be covered in many other sources on the internet and perhaps these explains the background more thoroughly, but I hope that my script will make it a bit easier to save flash videos.