The reason of deleting user information

[aria_opensource]

Hello, i use whm and cloudlinux. Information of a user public_html directory was removed , not by me
But user said that he didn’t remove that too.

How can i find the reason of deleting data inside the public_html directory ?!

Where i have to check in whm for debugging this problem?

 

[quietFinn]

Before anything else it might be good the check the wastebasket, in /homeUSERNAME/.trash

Customers sometimes accidentally remove things...

 

[cPRex]

WHM and the operating system itself doesn't keep a log of every user transaction, as that would just be an incredible amount of data to sort through on a busy server.

One thing you can check is the FTP transaction logs in /var/log/messages to see if there were any connections to that particular user during the time when the files may have been deleted. You could also check /var/log/secure for SSH connections to the same user, if SSH connections are enabled for that user's account.