Is there a way to tell who (which user) last modified the last file in Linux (RHEL)?
This is far from reliable, but if we are talking about shell access, you could cross-reference the file's modification time with the users logged in at that time (
last) and then check their ~/.bash_history (or equivalent) for editing commands. Even
grep -H filename /home/*/.bash_history could give you a starting point.