macOS Mavericks – How to Restore Deleted com.apple.mDNSResponder.plist

I had the same problem. I tried what Matt Love has suggested and still had the problems. I then downloaded Cocktail and ran permission repair, rebooted and all worked again.

Yes - by default, file deletions are logged along with many other important file sharing events.

Install the Server app on any Mac (or log into the server to run the app there or inspect the log file locally).

Select logs on the left, select AFP Access Log on the bottom and search for the word Delete. Once you've found the file deletion you care about, note the IP address and timestamp. Then search backwards in this log to see what user logged in using that IP immediately prior to that delete event.

You might also seek professional help if you want a forensic analysis rather than performing it yourself. Anyone that can look at the logs can change the logs and how you use this knowledge is more of a social problem than a technical problem. There should be Time Machine or better backups of the server shares, so you should be able to trivially determine the times files are deleted there as well with tools like Backup Loupe and hopefully you find that someone was careless rather than deliberate. Either way, OS X server has sufficient logging to determine a file access oddity if it came from a user that connected to the share as opposed to logging in directly to the server and deleting the file. That event would need additional auditing and logging, but I would start with analyzing the AFP access log since that's normally how files are accessed from a server.