Rouge admin deleted a user
 

Hey community folks. Real quick question here.

We have a situation on our boards where a couple of people did not get along and the one who was an admin "deleted" the others account. It happened a while back, and we are just getting to the point where we have discovered this.

Anyway, I checked the admin logs and found this...

5157 ### 18:19, 13th Jan 2007 user.php kill user id = 35
5156 ### 18:19, 13th Jan 2007 user.php remove user id = 35
5155 ### 18:19, 13th Jan 2007 user.php edit user id = 35
5154 ### 18:19, 13th Jan 2007 user.php find
5153 ### 18:19, 13th Jan 2007 user.php find
5152 ### 18:19, 13th Jan 2007 user.php modify

My question is this...

The first 3 lines, Kill, Remove, Edit user ID... is this telling me that this person did in fact delete this User?

Second,

We have well over 200 users, and the person that got deleted did not use the boards much, so we cannot in fact say that Admin X deleted user Y. I have tried to look everywhere to see if I can see what name was attached to this User ID, is there so place that this info would be stored so I can in fact say for sure that the person we believe to have been deleted by this admin was actually done. I cant base my case on a user ID with no name attached.

Thanks,

-N

Yep, He deleted that user.

Trying to find out who was user 35 is and should be as simple as this....

www.yoursite.com/forum/member.php?u=35

EDIT: but you won't find out who that user was if he was deleted

yes, thats the problem Red, He was deleted by the suspected Admin.

The situation is,

The admin denies he ever deleted him, or anyone for that matter. But the logs say different. But I cannot PROVE that he deleted this user, just the user ID. I even went into the sql database to see if I could find an old record, but not to good with that stuff.

I guess the reason you delete is to get rid of something forever, i guess it worked... hehehe.

Thanks for the quick replies btw.

logs don't lie... rogue admins do. ;)

If he denies to have ever deleted any user, then that log is clear proof that he is lying.

You have the logs. That IS proof.

there comes a nice question here........can he restore the deleted member or not?

Well, besides the fact that he denies deleting a user, to us its more important to find out who that user was.

we have the proof that he deleted a user, now we want to know what user it was.
With the record being deleted, we cant firmly say "Mr rouge admin, you deleted Jimmy"

We can only say he deleted a user. So, is there anywhere that this info could be stored that I can go back and associate this User ID to a username.

I just was not sure if Vbulletin had a built in "its deleted but not really deleted" kind of like email, or things on your HDD.

The only place where you might still find this information would be in the pmtext table if another member ever sent or recieved a PM from the deleted, and has not deleted that PM.

Other then that your only hope is that there is somewhere cached info (ie Google cache, a wayback machine, or maybe an old backup you have).