Z-particles were created when Armus used his powers. The crew of the USS Enterprise-D used sensor scans of these occurring as an indicator of Armus' power level when they encountered him at Vagra II in 2364. (TNG: "Skin of Evil").
In 2367, Lieutenant commander Geordi La Forge noted a sudden spike in z-particle readings at the time that the impostor styling herself as "Ardra" used one of her "magic tricks" to make the USS Enterprise-D "disappear." He analyzed the readings with Doctor Howard Clark and had trouble tracing the source of them because of their decay rate. La Forge, however, was able to correlate the particle trajectories and eventually was able to discover the impostor's vessel via a wavelength stretch out. (TNG: "Devil's Due")
Later that same year, when Geordi La Forge tried to find out what caused the mysterious disappearance of his former crewmates of the USS Victory on Tarchannen III, he scanned for z-particles, among other things. No z-particles were detected, however. (TNG: "Identity Crisis")