[speculatrix]

thanks for that. I have been exploring the file system and looking for the file which contains the users... interestingly, it seems that CP keeps a sequence of copies of the file fwauth.NDB with sequential numbers appended.

we are too scared to start copying and replacing files on this box, so what we're going to do is clone it (it's a compaq DL380) and then treat it as a forensic science project to find out if we can roll back some of the file versions, and then if it works do it to the live box!