We have a linux server in our lab which is shared among a number of developers. Server credentials (NOT root) are known to all and they log in using SSH. Now, when I logged in today I just realized that someone has deleted the folder I working on. It was there till yesterday EOD but has gone now. How can I know who deleted my folder ?
**EDIT :- **
I have just discovered the last
command with some greps
it gives a list of IPs from where a user logged in, that is great information, however it doesn't solve my purpose completely. I just want to know who deleted my folder. I just want to know if someone is willingly doing it since it has happened before also and restoring everything every time is just frustrating.