[halapro]

You can use fsevents to see which apps write where and firewalls will tell you which app is connecting to the internet.