I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
I was experimenting with a ubuntu machine for trying to find a solution for you. When you create a user and delete it and then create a user again, the second user takes the uid of the deleted user so it s hard to find the amount of users by this technic.
I suppose there is no command for your willing actions.
I think you re going to find your answer by doing some forensic stuff on your machine and try to see the paths of every deleted file and figure out the user who created or deleted the file.
I hope there is someone who can answer your question with more theory about this section of unix machines.