reboot can be done from local console via three-finger-salute, without even logging in. If it was rebooted this way, there will be no way of identifying the person.
The process of shutdown and restart on Linux is denied to a normal user. It can only be done by the super user or a user who has elevated sudo privileges.
if you are ready to use tool to accomodate your disks remaining raw space to any partition and you don't have problem in using tools then you can try gparted live CD ISO from this link GParted --...