/etc is just a symbolic link to /private/etc.
If the user just deleted /etc, you can easily restore it at the shell:
First, check the disk:
/sbin/fsck -y
repeat until you don't get any errors returned (1-3 times, usually).
Next, mount the filesystem and restore the symbolic link /etc -->...