So especially if my network connection is disabled and nothing can be updating in the background, unusual/heavy disk activity stands out and is easy to spot via Procmon. I typically disable background and scheduled tasks such as malware scans, backups, disk defragmenting, search indexing, etc and minimize the processes/services started up and running in the idle state. Did you say what OS you are using? Yes, Process Monitor would be a tool you could use to investigate filesystem activity (and other types of activity if those aren't disabled.
