Minecraft – Ideas for identifying a griefer on the Minecraft Realm by using save games

minecraft-java-edition

I run a Minecraft Realm for my children and their friends; I also play on it myself. Yesterday someone stole diamonds from someone's secret chest (breaking blocks to get into their secret room) and this morning someone exploded someone's TNT collection. At roughly the same time as the explosion someone again broke into the secret room (I know because this time they removed the blocks without replacing them). By restoring different save games, I was able to determine to within an hour at what time both of these events occurred. For both occasions, only two children had been online, the same pair both times.

Because I think I know something about the personalities of both these children, and because I have gently talked to both of them about this, I am 95% sure which of them did it. But I would like certainty.

I have downloaded the backup world files from either side of both these events and am exploring the data using NBTExplorer. An obvious clue would be that one of them had more diamonds in their inventory or store, but that was not the case. I think he might have just thrown them in the sea. Does anyone have any suggestions for what I could look for in the save game files which could help identify the culprit?

Best Answer

A big lead that should help you is the fact that you can access each of the player's statistics in the world's stats folder.

Inside the folder you'll see a bunch of JSON files, one for each player, named with their UUID:

JSON files

Open up the JSON files with any text editor, and you can look through everything the game stores to show the player on their statistics screen. One of the things you'll probably want to look for is if the player's "stat.useItem.minecraft.tnt" (how many times they've placed TNT) increased between the saves.

Another thing to check in the NBT data is both player's enderchests under the EnderItems tag; this may be where they are hiding the diamonds.

Using NBTExplorer, or MCEdit, you should also be able to check both player's coordinates before and after the incident, although it may be that whichever one did it ran far away immediately afterwards.

Related Topic