I run a Minecraft Realm for my children and their friends; I also play on it myself. Yesterday someone stole diamonds from someone's secret chest (breaking blocks to get into their secret room) and this morning someone exploded someone's TNT collection. At roughly the same time as the explosion someone again broke into the secret room (I know because this time they removed the blocks without replacing them). By restoring different save games, I was able to determine to within an hour at what time both of these events occurred. For both occasions, only two children had been online, the same pair both times.
Because I think I know something about the personalities of both these children, and because I have gently talked to both of them about this, I am 95% sure which of them did it. But I would like certainty.
I have downloaded the backup world files from either side of both these events and am exploring the data using NBTExplorer. An obvious clue would be that one of them had more diamonds in their inventory or store, but that was not the case. I think he might have just thrown them in the sea. Does anyone have any suggestions for what I could look for in the save game files which could help identify the culprit?