• @b0rk lsof will show which files are open, but activity is based on the syscalls performed. lsof's "offset" field isn't reliable.