Something like iotop -Pao (real-time) or iotop -obd (batch) ought to do the job. I don’t know if it includes writes to non-physical devices like tmpfs.
Some other commands you might find interesting: iosnoop, fatrace, pidstat, blktrace.
For read/write ops or disk usage over time, I would usually use a monitoring system like Prometheus and Grafana.
When you start talking about what specific files are accessed and when, that’s usually up to an intrusion detection system (or IDS). I don’t have good recommendations for that unfortunately.
Add comment