I found a simple program called KL-Detector that I run every now and then.
It's very simple. Just monitors all writes to disk while you're doing something, like typing on the keyboard. It will tell you who was doing disk writes during that time.
Do a google for it.