We’ve always had “joblogs” turned on so we can go back and view that information. If you do not already have that turned on I’m not sure you can recreate what they did.
Can you give more information?
If your Physical Files are journalled you can tell what the user changed and what files they opened (if that’s included in your journalling object journalling (if you are using this) would tell you any objects that were changed but not used. The history log may tell when a user signed in.