The Google Chrome cache directory $HOME/.cache/google-chrome/Default/Cache
on Linux contains one file per cache entry named <16 char hex>_0
in "simple entry format":
- 20 Byte SimpleFileHeader
- key (i.e. the URI)
- payload (the raw file content i.e. the PDF in our case)
- SimpleFileEOF record
- HTTP headers
- SHA256 of the key (optional)
- SimpleFileEOF record
You therefore cannot simply use file
to determine the file type (it will just detect data
), but must search for the PDF header. This will list all PDFs in the cache directory:
grep -Rl '%PDF' $HOME/.cache/google-chrome/Default/Cache
Note: This may give you false positives in case the string %PDF
appears somewhere in a file which isn't a PDF
Note: If you're not using the default Chrome profile, replace Default
with the profile name, e.g. Profile 1
.
evince
will happily read the cache file directly, without having to strip the header.
If you do want to extract the original PDF, save the following script as extractpdf.py
:
def main(cachefile):
with open(cachefile, 'rb') as f:
s = f.read()
with open(cachefile + '.pdf', 'wb') as f:
f.write(s[s.find(b'%PDF'):s.rfind(b'%%EOF')+5])
if __name__ == '__main__':
import sys
main(sys.argv[1])
And call it as python3 extractpdf.py <cache file>