X
Tap here to go to the mobile version of the site.

Support Forum

Explanation of how downloaded files are handled?

Posted

Strange question...

My company uses an EDR (endpoint detection and response) solution in its security stack. We've noticed a difference between how Firefox handles files downloaded from the internet when compared with Chrome, IE, and Safari.

One of the things EDR solutions record is when files are written to disk. If you download a file from the web -- we'll call it foo.rtf -- using Chrome, IE, or Safari on Windows you see a temp file being written to the TEMP directory while the file is being downloaded then you see the Chrome, IE, or Safari process write the actual file (foo.rtf) to the Downloads folder (or wherever you told your browser to put it).

When observing Firefox, we see the tmp file being written to the TEMP directory but then never see Firefox actually write the file foo.rtf to the downloaded location.

I guess my question is: does Firefox download the complete file as foo.tmp; move foo.tmp to the desired download location; then rename it?

Any guidance is appreciated.

Strange question... My company uses an EDR (endpoint detection and response) solution in its security stack. We've noticed a difference between how Firefox handles files downloaded from the internet when compared with Chrome, IE, and Safari. One of the things EDR solutions record is when files are written to disk. If you download a file from the web -- we'll call it foo.rtf -- using Chrome, IE, or Safari on Windows you see a temp file being written to the TEMP directory while the file is being downloaded then you see the Chrome, IE, or Safari process write the actual file (foo.rtf) to the Downloads folder (or wherever you told your browser to put it). When observing Firefox, we see the tmp file being written to the TEMP directory but then never see Firefox actually write the file foo.rtf to the downloaded location. I guess my question is: does Firefox download the complete file as foo.tmp; move foo.tmp to the desired download location; then rename it? Any guidance is appreciated.
Quote

Additional System Details

Application

  • User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

More Information

cor-el
  • Top 10 Contributor
  • Moderator
17205 solutions 155465 answers

Helpful Reply

Firefox should move the file to the final destination folder once the download has finished. If this doesn't happen the a possible cause is that other software keeps a lock (handle) on this file that prevents Firefox from completing the download properly. This can be security software that tries to scan the file already in the temp folder and isn't waiting until Firefox has moved the file.

It is possible that security software (anti-virus, firewall) is causing the problem. Try to disable security software temporarily to see if that makes a difference.

Boot the computer in Windows Safe mode with network support to see if that has effect in case security software is causing problems.

Firefox should move the file to the final destination folder once the download has finished. If this doesn't happen the a possible cause is that other software keeps a lock (handle) on this file that prevents Firefox from completing the download properly. This can be security software that tries to scan the file already in the temp folder and isn't waiting until Firefox has moved the file. It is possible that security software (anti-virus, firewall) is causing the problem. Try to disable security software temporarily to see if that makes a difference. Boot the computer in Windows Safe mode with network support to see if that has effect in case security software is causing problems. *http://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/ *http://www.7tutorials.com/4-ways-boot-safe-mode-windows-10
Was this helpful to you? 1
Quote

Question owner

Thank you for the reply. I'll have to do some xperf digging. Seems unlikely that an anti-malware software would only be issuing lock handles when Firefox writes files, but I'll keep going. I'll let you know what I find.

Thank you for the reply. I'll have to do some xperf digging. Seems unlikely that an anti-malware software would only be issuing lock handles when Firefox writes files, but I'll keep going. I'll let you know what I find.
Was this helpful to you?
Quote
Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.