I want to keep track of the application that created the folder. I use an Android phone. And some apps automatically creates unnecessary folders in the root directory of my phone. I want to know where they come from.(The photo below is an example.) I can delete that folder but it will be recreated within few minutes. Are there any apps or adb commands that can monitor whether a folder or file is being edited? Or, is there a way to block the creation of a folder with the same name? I have read all of the guides but may still be wrong. Please tell me if this is a duplicate question. I apologize if this is a bad question. I want to catch the culprit!

I have a rooted device, with superuser rights granted to a few apps I trust. I have often found my /system or /vendor partition mounted read/write, and some files chmoded to 0777. Similarly directories/files with random names are created/deleted (e.g. /sdcard/.a03Degpoif), .nomedia files are created inside them to hide their contents from gallery etc. logcat/dmesg contains no traces of all this happening in background. This doesn't happen periodically but in a slapdash way, internet connectivity isn't a condition either. I have tried disabling/uninstalling apps, looking for any suspicious processes running, but couldn't identify the culprit(s). Is there a way to figure out who is doing this?

There is a folder at internal memory: .space/ Inside it has one folder that is a big hash name (probably sha1sum), and inside that folder there are lots of files (also named as a hash something like 60b725f10c9c85c70d97880dfe8191b3.space) occupying 2.7GB of my smartphone precious internal memory. In hexa/chars/bytes, thru X-Plore File Manager, I saw that they begin with "PK", which means they are ZIP files. So, after renaming them to .ZIP, I saw many pictures inside them that were all about games, and the manifest.xml was Uber annoying to try to read. My conclusion, they were all unwanted, unasked, auto-downloaded .ZIP (.APK?) games. Now I need to stop the app doing that kind of thing on my precious cellphone's memory.

I'm using Android Excel and Word apps on a non-rooted Galaxy Note 8. Over the past months I've opened a couple of files from external sources (email and SD card), but was shocked to find these files could still be opened after the source was gone. It appears the files reside "somewhere" in /data/user/0. When I launch the app, it displays a file list including the path. I tried to delete these files and get a prompt saying I don't have permission. This is crazy! If I ever lost my phone, these sensitive files would be compromised!