Check the Activity log or another log for a restore history

Hi,

We have hired a consultant to do some internal penetration testing and they claim they were able to log in and complete some restores, but I cannot verify nor deny that, so I am wondering if there is a log that shows all of the restores that were done in the last week or last month preferably.

I am hoping there is a command where I can see this that goes back further than > mccli activity show displays.

Is there is a log on the sever that would show this, where would I look for it?  Or is there a log to show what a particular user has done.  They have told us what userID they used.

When I try to recreate the restores using the steps they provided, I am not able to do the restores.  Therefore I need to find some logs to verify or deny what they were saying to management.

Thank you

-Mike