if audit logs were not enabled, i would avoid pretending you can prove who did it after the fact. first priority is recovery and containment: restore the missing files from backup, check previous versions/recycle bin if available, preserve whatever indirect evidence still exists, and look at timestamps, open file handles, recent access patterns, endpoint logs, and any backup/sync logs that may show deletion events. after that, fix the process so you are not in the same position next time: enable auditing on the share, centralize the logs somewhere users cannot tamper with, remove delete rights where people only need modify/write, use separate archive or approval for sensitive folders, and make sure backups are immutable or at least protected from normal user access. the management answer is also important: “we cannot identify the actor because logging was not enabled, here is what we recovered, here is the control gap, and here is the change needed.”