well, if your ftp server log does not show him deleting those files...and his own personal log does not show him deleting those files, i would be pretty sure that those files were deled not from the ftp session..
look into your filesystem logs, see which process accessed/deleted those files..
__________________
[Sig removed by Administrator: Signature can not exceed 20GB]
|