Just want more clear on knowledgebase regarding tripwire .

Tripwire report can tell a file being modified with comparing with baseline generated by tripwire .
Also the report show who was the one last modified the file , I want to know “who” information that come from where and how ?

As Unix SA I can not recall any way UNIX system had this information restored in any file or inode .

Thank you .