To find which process and when, Filemon should do the job:

http://www.sysinternals.com/Utilities/Filemon.html