@bma_diy that is a real challenge… it could be an explicit attempt to open a file by a module, or it could be a browser request to download or upload a file.

so, I would start by searching thru all your installed modules for any file system functions

in the MagicMirror/modules folder do

find . -type f -name "node_helper.js" | xargs grep "require(\"fs\")"

that will show any module asking for the fs (file system) functions

on the browser side… more difficult. if this was chrome or firefox and u have a keyboard, I might try looking thru the history for accessed URLs…
I haven’t see a good use of history under electron