General ideas on researching deleted records

HI This is a general and long shot question.

It seems we have lost 2 days of invoices from a particular file.

How to research what caused this?

Developers are the primary suspects of course or rather process of elim.
while most
devs would never do some of these I am trying to see what may have happened
and how to locate any logs of these: by all means let me know if my
thinking is completely
wrong and how it should be looked for.

MY thinking is records get deleted by a dev if there is

1.any program (rpg/cl ?)  that outputs to that file
2. A Cpyf to that file, overlaying blanks i guess.
3. command but a dltf would be halted bec logicals exist.
4. Upddta. this shop uses upddta a lot, not just developers. but then it
has to be F23 and a lot of those.

Thank you for any concrete info I acknowledge this is a fuzzy topic if this
is fully off topic please remove.

Thank you,
Joe