Just quickly thinking of where there might be a lot of images/documents modified quickly: web browser cache, photo management software, antivirus software.
I think it'd be easier to isolate applications and data like Cubes OS instead of trying to create a universal rule set.