check the filemon utility, or write a script that checks if the directory is still there in periodic intervals, and write to a logfile with timestamp
then you have the specific time
I would check first:
1. automated process on the machine, per cron perhaps
check every users crontab (crontab -l) that has the rights to delete the folder, and check for user created scripts running
2. automated process outside the machine
triggered per ssh, telnet, rsh...
you can compare the time from your scripts logfile I wrote above with the login logs on your server an find out the IP (last, syslog)
3. manually triggered by a user, but seems not very likely
like step 2, analyse login logs for that
very scary