First, find the browser process id:
$ ps xfa | grep firefox # or grep any other browsers' name
Say, we get 12279. Note that you may get more than one result from the above command: you need the process id of the binary executable. The firefoxcommand, for instance, is normally a script which starts the real binary.Then, list its opened files, by:
$ ls -lU /proc/12279/fd
This will show you the files opened by the process, there may be a lot of them. The file name is the file descriptor number, it is a symbolic link that points to the real file that is opened on that file descriptor. The output will look something like:# NAME REAL FILE
lrwx------ 1 grp usr ... 59 -> socket:[3372642]
lrwx------ 1 grp usr ... 62 -> /home/gektop/.mozilla/firefox/u824gy5z.default/signons.sqlite
lrwx------ 1 grp usr ... 70 -> /tmp/moz_media_cache (deleted)
lrwx------ 1 grp usr ... 73 -> /home/gektop/.mozilla/firefox/u824gy5z.default/places.sqlite-journal
lrwx------ 1 grp usr ... 74 -> /tmp/FlashZzxRDM
lrwx------ 1 grp usr ... 75 -> /var/tmp/etilqs_5I5bzLh21aIoh4a (deleted)
Now look for names matching the pattern "/tmp/Flash??????". In the above example, we see /tmp/FlashZzxRDM. This is really a .flv file, you can open it with mplayer or any other video player and see that it is a video. If you see more than one file you may need to try playing them to see which one you're looking for.The last step is to simply copy the file to your home directory, renaming it in the process (e.g. "jackson.flv"). Wait till after the browser has played the entire video, otherwise you may get an incomplete file.
No comments:
Post a Comment