Ideas for identifying a griefer on my Minecraft Realm by using save games?

I run a Minecraft Realm for my children and their friends; I also play on it myself. Yesterday someone stole diamonds from someone's secret chest (breaking blocks to get into their secret room) and this morning someone exploded someone's TNT collection. At roughly the same time as the explosion someone again broke into the secret room (I know because this time they removed the blocks without replacing them). By restoring different save games, I was able to determine to within an hour at what time both of these events occurred. For both occasions, only two children had been online, the same pair both times.

Because I think I know something about the personalities of both these children, and because I have gently talked to both of them about this, I am 95% sure which of them did it. But I would like certainty.

I have downloaded the backup world files from either side of both these events and am exploring the data using NBTExplorer. An obvious clue would be that one of them had more diamonds in their inventory or store, but that was not the case. I think he might have just thrown them in the sea. Does anyone have any suggestions for what I could look for in the save game files which could help identify the culprit?

Solution 1:

A big lead that should help you is the fact that you can access each of the player's statistics in the world's stats folder.

Inside the folder you'll see a bunch of JSON files, one for each player, named with their UUID:

Open up the JSON files with any text editor, and you can look through everything the game stores to show the player on their statistics screen. One of the things you'll probably want to look for is if the player's "stat.useItem.minecraft.tnt" (how many times they've placed TNT) increased between the saves.

Another thing to check in the NBT data is both player's enderchests under the EnderItems tag; this may be where they are hiding the diamonds.

Using NBTExplorer, or MCEdit, you should also be able to check both player's coordinates before and after the incident, although it may be that whichever one did it ran far away immediately afterwards.

Solution 2:

The easiest way to know for certain is to ask them directly with their parents present, both at the same time ideally. Tell their parents that someone has been bullying other kids in the online game you host and that, based on the logs, you can determine that the only people online at the time were their kids. Then you can let the parents discuss this with their kids and take the necessary steps.

Alternatively, you say they blew something up and destroyed blocks, right? You could in theory check if one of them has lost materials that can make a button, a redstone torch or a lever, and how much durability their pickaxe and/or axe has lost. However, this would be much more intensive to check, because you also need to verify that they didn't lose that in another way.