I want to see which files are read or written to.
Is there any program or a command for that? I can remember I used this method to hunt down viruses and malware hiding locations when I used windows a few years back.
That program is
Remember that some processes are started by the superuser root, you may need to put
To narrow down your search, you can
As a complete over-kill option, but one that works in real-time, you can use inotify:
Note that this will consume a great deal of memory, and take a long time to set up. As the manpage says:
This also doesn't tell you what process is messing with files, but it may help identify changes as they happen. Using "-e open" may help reduce some of the noise on a really busy system.