--this shows you what is being written to, instead of grep -i write, you could try cache_hit or just leave out the grep stuff and filter later, this is the OSX command you want I believe. It is a spin off of the Solaris dtrace utility which reads real time system calls and what not. You will learn what to filter by looking at the unfiltered output first, if you want to know what a specific process is doing, writing, etc, then grep for it, you should see the process on the left and the files being touched on the right when it's writing to a plist which is what I assume you are trying to figure out.
Unix also has the find command, that can (in some shell flavors) use
-amin x (where x is accessed in past x minutes)
-atime x (where x is # days back it looks for access)