Auditd would show frequency, the process name and uid that did the write, and when, etc. Last modified time isn't always enough.