Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I am using lsof to view the list of open files. One such file that it displays open is :

Google    3864 malaykeshav   46u     REG                1,1 470455334 32578671 /Users/malaykeshav/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/

But when I go to the location and run a sudo ls -al no such file is displayed. How do I access this file?

My current directory where I am executing ls is

/Users/malaykeshav/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash 

lsof displays this file open after exectuing ls.

share|improve this question
the file maybe not exist anymore, if you open a file, it can be loaded into ram and then delete and being open as long as your program run it. try to restart chrome – Kiwy Jun 27 '14 at 9:18
Even after loading it onto RAM and deleteing it from the drive, the lsof will display it ? – Kyuubi Jun 27 '14 at 9:20
Yes, it's in fact one technic used by hackers to lunch a proxy sock on a corrupted server and delete all config and executable file. if the server is never rebooted, and nobody noticed the sock process, it runs without being physically on the disk. – Kiwy Jun 27 '14 at 9:54
@Kiwi, it's not about loaded into ram. If it's open by a process, a file is not removed from disk when it's unlinked from the last directory it was linked to. Kyuubi, yes on MacOS/X, at least with the lsof provided by Apple, lsof reports it even if the file has been unlinked. On Linux, you see (deleted) appended to the end of the filename. – Stéphane Chazelas Jun 27 '14 at 9:56
@StéphaneChazelas thanks for the precision. I tend to simplify a bit too much and not understand every process ;) – Kiwy Jun 27 '14 at 10:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.