I can not think of a "standard" tool/utility that keeps track of such information, but you might be able to look at the file permissions, to see who could not have edited it. Then look at the last modification time for the file (man ls) and cross reference that with the last command to see when users were logged in. Then you would have (hopefully) a smaller list than every user onthe system, and you could search out the .sh_history files to see who it could be.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.