Urgent Help Needed: Password Change Logs?

[Ganga]

Hello everyone.

I do apologize for the urgency of the matter.

One of my customers has had his site stolen by former associates of his and the password changed.

As he has reported the facts to the Police, they are now asking for me for the access logs.

I was also thinking if perhaps there is a file which records Cpanel's password changes, preferrably with IP address recorded.

Can someone please shed some light on this?

Thanks for your help.

[chirpy]

If they're still there, they'd be in /usr/local/cpanel/logs/access_log