Is that possible?
I wanna know the file(s) involved whenever a disk activity occurs.

My guess is to load urself into ring 0 and intercept VM msgs.
but I guess it can be done in an easier way.

Know how?