Reservation sys files

[webarts3000]

Network Aministrator I need your advice
If you suspect Hacker has changed info on some of the files you got in your Network.
What administrator system files would you look into in order to see what items has been erased, modified etc.??

Webarts3000

[Allan]

Please don't post the same question more than once. I deleted the duplicate. Thank you.

[Rob Pomeroy]

What sort of a network?  What operating systems are involved?  Is accounting switched on, on the file systems?