Monitor How and When a Process Accesses Files with opensnoop
You can watch what a process is doing with your filesystem by using the opensnoop command. To try this out, launch the Terminal and then follow along to learn how to watch by applications, file usage, process ID, and more.