There are some good "operating system level" utilities, complete with source code available at sysinternals.com. This includes registery monitoring, cache monitoring, TCP monitoring, watching what processes are running and what DLLs thay have loaded, monitoring file activity and lots more. There is also a Linux program that lets you monitor file activity in real time.