You could create a file in /tmp that has the time of the login you're interested in with the touch command:
e.g. to create file for 3:30 PM on June 3rd:
Code:
touch -t 201006031530 /tmp/findref
You then do a find looking for files newer than the time on that touched file and owned by the user in question:
Code:
find / -newer /tmp/findref -a -user <username>
Of course if the user had permission to become root or another user with the su command and used that other user to create the file he wouldn't be the owner and there's no easy way to find it. You could try running "strings" on .bash_history (or .sh_history for ksh) in his home directory to see what commands he executed but that won't tell you WHEN he executed them. You could also do it for whatever user he su'd to.
