Just to be clear.
some one deleted few files or something happened?
Is this activity done inside the Guest? If yes, then you need to check inside the event manager in windows or var/log/messages in linux.
How to find out the root cause analysis?
If the change is done in the esx, then you can always look at "history" command, if it is in ESXi 4, then unfortunately you cant, other than checking with var/log/messages