There is a file .log where you can see the commands applied via terminal in Linux , I usually apply the command history to verify previously executed commands, but this time they deleted the history and I have no trace of which user I apply command.