I have an issue where somewhere deleted a directory on the NSS volume.
We automatically purge the volume every sunday for any files that have
been deleted that are older then 10 days. Well the "manager" could
only tell us that back on Jan 21, was the last time he used it. We
restored the directory from tape for him but he is very demanding that
we find out who did this from his group. I explained to him that we
are dealing with a Netware file system (NSS) and he is trying to say
that there is a way to find this information out, (Forensic guy). I
imfored him that there probably is a way but I don't have the utilities
to do this sort of thing.

Is there any other way of determing who deleted a file if the files and
directory have already been purged form the volume?