Cheers eComLabs that appears to be more what we were thinking of.
Vivek, basically at the moment it doesn't have enough information for us to be able to tell exactly what happened. Between DB backups we can see what it was and what it became, and by looking at the logs we can see something was done by a certain person but we don't know for definite what was done.
So if I look at this as an example:
----------------------------------
Products (update)
Product: Product 123 Administrator user - 123 — 12/09/2016, 17:33
----------------------------------
I can see the product was updated, but what was updated? If the several admins made several updates between the backups I can't say "this admin did this".
An example of what would be useful is as follow:
----------------------------------
Products (update)
Product: Product 123 / CODE: 123 / PRODUCT DB ID: 74
Price updated:
150 -> 200
Full description removed:
Jeff likes ketchup with his chips but it can't be mayo!
Short description changed from:
Remember, no mayo!
Short description changed to:
Remember ketchup!
----------------------------------
----------------------------------
Administrator user - 123 — 12/09/2016, 17:33
Products (removed)
Product: Product xyz / CODE: XYZ123 / PRODUCT DB ID: 36
Download database dump of product Administrator user - 123 — 12/09/2016, 17:36
----------------------------------
A download of the product doesn't need to be dumped into a file if the product was marked as deleted instead, but at the moment you wouldn't know what was wiped.
So that's an example anyway.