Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using lsof to view the list of open files. One such file that it displays open is :

Google    3864 malaykeshav   46u     REG                1,1 470455334 32578671 /Users/malaykeshav/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/.com.google.Chrome.CiGbDZ

But when I go to the location and run a sudo ls -al no such file is displayed. How do I access this file?

My current directory where I am executing ls is

$pwd
/Users/malaykeshav/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash 

lsof displays this file open after exectuing ls.

share|improve this question
    
the file maybe not exist anymore, if you open a file, it can be loaded into ram and then delete and being open as long as your program run it. try to restart chrome –  Kiwy Jun 27 at 9:18
    
Even after loading it onto RAM and deleteing it from the drive, the lsof will display it ? –  Kyuubi Jun 27 at 9:20
1  
Yes, it's in fact one technic used by hackers to lunch a proxy sock on a corrupted server and delete all config and executable file. if the server is never rebooted, and nobody noticed the sock process, it runs without being physically on the disk. –  Kiwy Jun 27 at 9:54
4  
@Kiwi, it's not about loaded into ram. If it's open by a process, a file is not removed from disk when it's unlinked from the last directory it was linked to. Kyuubi, yes on MacOS/X, at least with the lsof provided by Apple, lsof reports it even if the file has been unlinked. On Linux, you see (deleted) appended to the end of the filename. –  Stéphane Chazelas Jun 27 at 9:56
    
@StéphaneChazelas thanks for the precision. I tend to simplify a bit too much and not understand every process ;) –  Kiwy Jun 27 at 10:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.