Who renamed a directory?

That is not information that is normally recorded, unless you took special disposition to that effect (like via some audit system).

The service through which the user has renamed the directory (like over FTP, SFTP, WebDAV, samba...) may have logs that can help. You can try and check those logs, the last, lastcomm, audit, authentication logs around the time the folder was renamed.

If you're administrator, you can look at the history file of the shells of the users that had the permissions to rename it (if the directory was renamed from /A/dir to /B/newdir, it's whoever had write access to both /A and /B (assuming /A didn't have the t bit in its permissions and /A/dir and /B are on the same filesystem)).


You can't. As renaming a directory (or a file) is changing an entry in a (the parent) directory, it must have been someone with write permissions to that directory, but it is not registered anywhere who changes files/directories.