Hi. On Fri, Sep 07, 2018 at 02:46:31PM -0500, Richard Owlett wrote: > In this case I know the file's extension and VERY approximately when the > name was changed. > > In the appropriate time period I know that there were no more than a dozen > files created/destroyed/renamed. > > Is there a relevant log file? There is, but you had have to enable it first. It's called kernel audit facility, the package is "auditd". Reco