Gateway Backup Metadata

Is there a way to tell who made a gateway backup with only the backup file itself? I’m going through some kind of forensic activity, as we had an incident at a plant where a primary gateway reverted from version 7.8.4 to 7.8.2 (but not the backup). This piqued my curiosity, and I’m trying to trace back through what could have happened.

I know the backupinfo.xml has the time and the version of the backup, but I don’t know of anywhere to find the user that took the backup