Question: Inside my Documents folder there are a bunch of folders named with what appear to be hexidecimal numbers, eg. `01`, `1b`, `84`, `aa`, etc. Often they're empty, but some have one or two files named with a hash: `5aaebbb6c171adb2159c17cd1c8e629fc774f1be.file` I assume the files are binaries because when I open them in a text editor they consist of rows of eight two digit hex values, `00eb babf 314c 00eb babf 3130 d3aa 0109`. 
I deleted the folders a few weeks ago, but they slowly grew back.

My question is twofold:

1. What is writing these files/folders?
2. And because I doubt it can be diagnosed from my description, how
do I monitor and figure out what is writing them?

I'm on 10.11, El Capitan.

I sometimes run a Windows VM in VirtualBox, I run Vagrant from the command line, and Docker as well. I run phpstorm, Spotify, uTorrent, Steam, Slack, Skitch, Xcode, Tunnel Bear. The list goes on. I guess what I'm looking for is a strategy or technique to figure out which application is writing.

Answer: 
A few things for you to try: 

Per [this](https://stackoverflow.com/questions/8317177/see-what-process-is-using-a-file-in-mac-os-x) SO link, do `lsof path-to-filename` to list all processes accessing that file. There's also a frontend to lsof called [Sloth](http://www.sveinbjorn.org/sloth). The problem with this is if the programme doing the writes only edits the file momentarily (like if it did `touch foldername`) then you probably wouldn't see it, since `lsof` only lists current processes' access to the file.

Alternatively, get [FSeventer](http://fernlightning.com/doku.php?id=software:fseventer:start) ([direct download link](http://web.archive.org/web/20131203182705/http://www.fernlightning.com/lib/exe/fetch.php?id=software%3Afseventer%3Astart&cache=cache&media=software:fseventer:fseventer.zip) from archive.org - in my ([klanomath's](https://apple.stackexchange.com/users/93229/klanomath)) opinion the only reliable source), which graphically monitors filesystem IO events. You could probably set it to run on your documents folder and then wait for one of those writes to happen, although based on your description that may take a while. The website for FSeventer seems to be down right now :(, but if/when it goes back up it may be able to solve your problem. FSeventer isn't really ElCap ready and often fails to work after the first launch - usually it works after launching it a second time.
This is specific to my set up, and I didn't do anything in particular to find out what was writing to Documents. But, maybe this will help someone in the future. Spotify was set up to write cache to Documents.