empty XXXXX.html.part files remaining on desktop - can't find their origin

For a while, some application/system part leaves files with names such as 2F__qbBz.html.part on the desktop. At least when I discover and inspect these, they all are empty (size 0).

I am using Kubuntu 22.04, and this behavior certainly did not occur in the past. However, so far I have not been able to find the source of the problem.

What application may generate these files? It looks like some intermediate result from an HTML file download, but what application could place such intermediate files on the desktop?

@sarnold's answer helped me track this down. I'm on ubuntu focal using Thunderbird 102.4.2.

The temp files are placed there by Thunderbird and not removed under some very specific conditions. I have to be (a) writing an email in the Thunderbird editor, (b) have attached a file, (c) opened the file, and (d) the file has to be one of a few file types. .pdf files leave .html.part temp files and .docx files leave .docx.part files. Other file types like .txt or .jpg place a similar file but clean it up after closing.

That was a fun hour I spent chasing the origin of these weird files!

I found out they appear when opening files with Okular which appears to use the Desktop as temp dir. Didn't find an option where this can be changed, though.

funny enough you can change the folder where these files are being created by changing the "save files to" in thunderbird (even though this option is not selected)

I suspect the other answers blaming a browser are likely correct, but they don't give any advice on how to find out for yourself.

There's a few tools that can help:

• opensnoop-bpfcc from the bpfcc-tools package: run sudo apt install bpfcc-tools ; sudo opensnoop-bpfcc
• fatrace from the fatrace package: run sudo apt install fatrace ; sudo fatrace
• auditctl from the auditd package. This is a heavy complex piece of software, if you're not already running it, I wouldn't recommend using it here. If you're already running it, look for -F file watches in the documentation.

I've had better luck with opensnoop-bpfcc than fatrace, so my preference is to use opensnoop-bpfcc, but fatrace is popular with many people.

$ sudo opensnoop-bpfcc 
[sudo] password for sarnold: 
PID    COMM               FD ERR PATH
5541   i3status            4   0 /etc/mtab
5541   i3status            4   0 /proc/loadavg
5541   i3status            4   0 /proc/meminfo
2252844 MemoryPoller       57   0 /proc/meminfo
3147   thermald            9   0 /sys/class/powercap/intel-rapl/intel-rapl:0/intel-rapl:0:2/energy_uj
3147   thermald            9   0 /sys/class/powercap/intel-rapl/intel-rapl:0/energy_uj
3147   thermald            9   0 /sys/class/thermal/thermal_zone5/temp
2252844 glean.dispatche    57   0 /home/sarnold/.mozilla/firefox/q9a14s71.default/datareporting/glean/db/data.safe.bin
2252844 glean.dispatche    57   0 /home/sarnold/.mozilla/firefox/q9a14s71.default/datareporting/glean/events/events
...

In this output the PID column shows the process identifier, the COMM shows the first 15 characters of the program name, ERR of 0 showed the file opened successfully, and the PATH shows the best guess of which file was opened. (The FD column shows what file descriptor the process uses to access the file. It won't be very helpful here.)

Run this in a terminal and check the output as you use browsers, download files, etc. Hopefully you'll see the results quickly.

If you run ls -la ~/Desktop/ in your terminal, you will see a list of files on your Desktop. In this list find the file in mention. You will see a User and Group who is the current owner of the file. This might give a hint to who created it.

These are temporary files created when you download a file via your browser. Annoying and ugly but not "real". For some reason, Nautilus doesn't update its view when the browser finishes the download. If you switch to a different directory and switch back, the icon representing the temporary file will be gone.