Yes, the audit log will serve the purpose. Note that, in some cases,
it is not straightforward to search the log for deletion since a
directory (or a file) may not be deleted directly -- it may be deleted
as a part of the deletion of its parent/ancestor directory. So we
should first search the full path in the log. If it is not found,
search the parent directory path and so on.
It will be more complicated if deletion and re-creation occurred repeatedly. For example
1) user A: create /foo
2) user A: create /foo/bar
3) user A: del /foo
4) user B: create /foo
5) user B: del /foo
Who has deleted /foo/bar? It is easy to mistakenly take user B as the answer. B is the last user deleted foo but B
is not the user deleted /foo/bar. In such case, we should first
determine when the target directory/file is created and then search what
happened of it starting from the creation time.
You can imagine that it is even harder to find out the correct answer if the path or the parent/ancestor paths are moved/renamed. We need to pay extra attention if the rename operation is involved.
