During my hunt for the anime movie ghost in the shell, I downloaded a ‘rar’ed file. I found out after the download, that it was password protected. I did not expect that. But there it was, 700 MB file in my system but I could not use it. I decided that I would let a brute force password cracker run on it for as long as it wants. But my madness for the anime got over me and I stopped the software in an hour. I remembered that while trying to unrar, the entire movie file was getting extracted . The important fact is that the entire file is extracted. I just had to find a way to stop it from getting removed. For my purpose, it did not matter why it was extracting the entire file. We know it has to use some system call to remove the file. With that knowledge, I ran unrar under gdb and inserted breakpoints at remove and unlink system calls. And, my luck, the breakpoint was hit! I could see the entire file sitting in my directory waiting for it to get copied before rar removes it.
Unfortunately the movie was in japanese without any subtitles. I had to start the search all over again.