Alert when a partition is read/written

mount.ntfs is a FUSE "userspace filesystem" host – it actually mounts a filesystem at /storage and will access the disk whenever some other process wants to access the filesystem.

So, start by monitoring the filesystem – install the fatrace tool, and run:

# cd /storage
# sudo fatrace -c

(The -c option limits trace events to only the filesystem corresponding to the "current working directory".)

Every 'O'pen, 'R'ead, 'W'rite, or 'C'lose will be shown together with the corresponding PID and command name. (It uses the fanotify API, which is somewhat similar to inotify, but system-wide instead of per-directory.)