**TL;DR**: I know a program creates and then deletes files in `/tmp`. How can I intercept them for examination ?

**Context**:

There's a particular `.jar` file, which I don't trust; for some reason its source code contains an ftm method and has capability to make connections, which is evident from network-related syscalls in output of `strace` (and when I mean connection, I don't mean unix domain sockets, it's `AF_INET6`). I've examined with Wireshark and saw no outgoing TCP or UDP connections during it's use. 

However, I still don't quite trust it. From the output of `strace` I've seen that it's creating temporary files in `/tmp` and then deletes them. Is there a way to intercept those files to examine their contents ?