/etc is just a symbolic link to /private/etc.
If the user just deleted /etc, you can easily restore it at the shell:
First, check the disk:
/sbin/fsck -y
repeat until you don't get any errors returned (1-3 times, usually).
Next, mount the filesystem and restore the symbolic link /etc --> /private/etc:
/sbin/mount -uw /
/bin/ln -s /private/etc /etc
reboot