This question already has an answer here:
TL;DR: I know a program creates and then deletes files in
/tmp. How can I intercept them for examination ?
There's a particular
.jar file, which I don't trust; for some reason its source code contains an ftm method and has capability to make connections, which is evident from network-related syscalls in output of
strace (and when I mean connection, I don't mean unix domain sockets, it's
AF_INET6). I've examined with Wireshark and saw no outgoing TCP or UDP connections during it's use.
However, I still don't quite trust it. From the output of
strace I've seen that it's creating temporary files in
/tmp and then deletes them. Is there a way to intercept those files to examine their contents ?