I'm on the horns of a dilemma. Someone of the local network deleted a directory from the public share and I want to find who did this.
I have searched the smbd logs but no answer till now. How can I easily do it ? I know the date but the logs show nothing, I found that when I create a file/directory on that share samba logs this event. So, for deleted files/folders there must be some notes somewhere ... The thing is I don't really know for what word to grep.
Can anyone give me some tips on this ??