There are many ways you could be skinning this particular cat; but I suspect the following is true; or similar:
In Linux you have a crontab entry which executes the Linux script at a certain point in time, daily.
That script will exist in Linux somewhere and will have steps within it.
One step will be a d3tcl command to run some d3 command that performs the actual file-save; answering the prompts with data-stacked answers to the file-save AND with Linux std-out [screen output] redirected to a certain file in the Linux space; with overwrite. That is, it obliterates what is already there and starts over.
The next step will be something which 'sends' the backup to another location; also with screen output redirected to the SAME Linux file, but this time with append [or at least that is what should be happening]. We know the transfer itself is happening as the reported file size looks about right.
Finally the script emails you that Linux file using it as the body of the email.
If so, it appears either the first step's redirected output isn't happening [you could comment out the following-on lines, run the script and see what makes it to the Linux file] for some reason. Or it is happening, but is then being over-written by the follow-on command instead of being appended to the Linux file. A similar debug method would help diagnose which.
That's where I'd start looking: it's all in the script that runs. Step through that and see what's happening.