I'm not a Windows user but I'll give you a few suggestions based on what I see in your question. First though, I'll say that this kind of reverse engineering is not the ideal way to learn things. I think it is tempting because it seems to provide a shortcut versus actually reading documentation and experimenting on that basis, but like a lot of "I don't need to know all that" shortcuts in computing it may turn out to be a rabbit hole involving a colossal waste of time. I.e., it's not a shortcut, it's a wrong turn.
That said, if you want to run a process and see what system calls it makes (reading and writing to files always involves sys calls), you can use
strace. It will probably provide you with more information than you were looking for; in this case you want to connect
open() calls with numerical file descriptors and follow the trail of
write() calls subsequently using them. Strace probably isn't installed by default so you'll have to find the package (probably just
apt install strace). And yes, it has documentation of its own, as usual, start with
In order to ask less questions here and to spend less time on Google
A common mistake made by people here involves one or more of the following premises:
That GNU/Linux was born yesterday.
That linux was an obscure seldom used platform until the Raspberry Pi came along, and now most of the mainstream user base are Raspberry Pi owners.
That Raspbian is so different from other GNU/Linux distros that the decades worth of documentation available for the latter can't be applied to the former.
All three of these are very, very wrong. Implicit or explicit belief in one or more of them, however, leads people to constantly include "Raspberry Pi" instead of "linux" when searching online. Don't do that unless it really is something about the pi. Don't use them both, either, because it still biases the results and "Raspberry Pi" specific blogs and tutorials about general linux topics tend toward the low end of the spectrum quality wise. Further, if you do this continually with google with a browser on one computer, or as a google user (i.e., with a gmail account etc.) it is going to slowly introduce a bias into your search results over time such that it starts to appear as if one of the above premises might be sort of true. Which they are not. At all. Again: Very wrong.
We do, BTW, have a larger sibling site, Unix & Linux, on which questions like this are more appropriate. There is some obvious cross-over here so it is a gray area "on/off topic" wise -- sometimes it is good for people to handle certain common problems here, but sometimes it also, unfortunately, feeds back into the "low end of the spectrum" mentioned earlier.
I don't want hashing of files, since this would require a lot of unnecessary overhead.
System and process monitors, etc., on linux get their information from file nodes in
/sys, which are special filesystems (procfs and sysfs). They don't exist on any storage medium, so there is no I/O bottleneck, which is the major "unnecessary overhead" associated with "hashing files" (unless you just mean having to parse data in which case "computer programming" tends to be about nothing but "unnecessary overhead"). The point here is they constitute a language agnostic API for interfacing with the kernel. Yes, they require use of system calls like open and read, but there is no operating system where you can get information from the OS without making sys calls -- that's sort of by definition what a sys call is.
man proc is a good introduction to some of the information available.