Let's start off by saying this will not work if they used Xray BEFORE you got the plugin.

Links we will be using:

CoreProtect
X-Ray Block Percentage(XBP)

How to set them up:

CoreProtect:
Download the plugin and restart your server or use /reload. It is not recommended to just reload, as the Bukkit reload is known to create bugs and memory leaks. This will create a folder inside your "plugins" folder called CoreProtect. Inside there will be a file named config.yml. You can chose to right click this and open it in an editing program and edit it to your liking.(I suggest Notepad++ for configs and yml files). I will leave this at default, as you would really only change this when it comes to rolling back griefs and such, which we are not doing in this tutorial.

XBP:
This will not work without CoreProtect. The plugin itself can also use Logblock or Hawkeye, but we also use other methods that do use CoreProtect and I do not know if the other plugins can do such/how you would do it with them. Download the plugin and restart your server or use /reload. It is not recommended to just reload, as the Bukkit reload is known to create bugs and memory leaks. This will create a folder inside your "plugins" folder called XBP. Inside there you will be able to find a config.yml for that plugin.

There is some things in this folder that I have changed and I recommend you do too. We will be messing only with the top section in this tutorial. Here is what we will modify:

Picture

First we are going to mess with the search-time. When you first download this it will be at 48. What this means is that when you checked how much a person has mined, it will be for the past 48 hours(or 2 days). I suggest modifying this to a really high amount, so you can see for a long time. I did 9001(over 9000), and I figured out that is about a year, plenty of time. Note that if you have this to a very high number it could take a while to load depending on how many blocks the player has mined and how many block-ids you have set(see below).

The next variable is cooldown-time. We are actually not going to mess with this in this tutorial. The default is 2, and you can modify this if you know what it is for and wish to use it.

Then we have block-ids. The defaults are 14, 21, 48, 129, and 56. Those are the item IDs for Iron Ore, Gold Ore, Lapis Ore, Mossy Cobblestone, Emerald Ore, and Diamond Ore. I chose to add 49(obsidian) for my own knowledge. You can add anything you want, but make sure to keep anything you might want(eg. diamond ore for Xrayers).

Finding the Xrayers

You still actually have the FIND the players who use the Xray. How I do this is if I see a player with diamond armor(or whatever I think they used Xray for, such as iron for iron bars or gold for apples) and I don't see them on much or I know that they are new, I check them. Or if I see a chest with loads of diamonds I check who put them in(can be done with CoreProtect, see below) and I check that player. Now we are going to go into how we tell if they really did Xray.

First use this command:
/xbp {username} - Do not include the brackets{}. Also make sure you type the username in all lowercase. This is case sensitive to lowercase, it doesn't care if the name has capital letters, it wants lowercase. You will get an output like this:

Picture

This is what the player has mined. Look at what you are checking for Xray(in this case diamonds), and see if it is a high amount. If it is low, a friend might have done it or they might have raided a base. Compare it to the other numbers. I do not have a specific formula of how to do this, but if somebody has 300 iron ore and 64 diamond ore mined, I suggest you check them out. Or if you see a really high amount of Mossy Cobblestone, they might be Xraying for dungeons, or they might have just found a jungle temple. You could also look into this.

One thing I(and many others) often forget about is that they have percents, not just numbers. If you are not good with how much iron they should have mined to get a diamond, look at the percents! I do not use them,, so I cannot recommend a certain percent, but feel free to check a player you know is legit and base it off if they are near him. For example: I have a player on my server who I know doesn't Xray(personal friend), and he has mined 48 diamonds, but also over 600 iron. His diamond percentage is %0.02. If it is above %0.10 or %0.20 then yo might want to check them out.

Do they really Xray?

Here is how we will check. We are going to finally use CoreProtect! This step is not needed, but I like it to confirm my suspicions of Xray from /xbp or chests. Command to use:
/co lookup {username} b:{ID} t:{time span}

{username} - Obviously this is who you are looking up, whatever player you think uses Xray. Sometimes following a u:(such as u:{username}).
b:{ID} - This is what block you are looking up. I use 56 usually, which is diamond ore. If left blank it outputs all blocks mined/broken.
t:{time span} - This is how long you are looking back. I use an outragous amount such as 1000d(d=days, m=minutes, s=seconds, etc.)

This will give you a list, and will look something like this:


There you see the coordinates for the diamond ore. If next to the (-1) is not #56 you did not lookup the correct block. For diamond ore, there would only be (+1) if they had a Silk Touch pickax and decided to place the ore. Now what you will see is how long ago it was mined(in this case 4.73/h, which means hours). Then you will see by who(Sweendog_22). This should be whoever you looked up. Lastly you will see some coordinates.

Our first coordinate here is x1313/y15/z-627. What we are going to do is TP to it. The command I use is in essentials, so I would type this:
/tppos 1313 15 -627

This will take me to the X(1313) at the Y(15) I entered at the Z(-627) I entered. You will either be in a cave or a tunnel. If you are in a cave, it is not likely Xray. This is why we do what we do later. If you are in a tunnel, you get to have some more fun. Follow the tunnel back for a bit. If it seems to be completely random and not in any order, eventually leading to the surface, there is a really good chance it is Xray. If it is a strait tunnel for a long way with other congruent tunnels branching off a long tunnel, it is most likely somebody strip mining.

Now that we have checked one, I will check a few others that are farther away. I do not have an example for this one, but it is just the same to TP, and just the same to check. You will want to check about 5 different locations. If you run out of places on the first page, try this command:
/co l 2

This will show you the next page of mined diamonds. The more diamonds they mined the more pages there will be. Depending on how big the patches they found or xrayed for were will decide on how many pages you will have to go back. To go back farther, just change the number by adding one. So /co l 3, /co l 4, etc. This will only go back for the last person you looked up, and will not work if you reconnected, reloaded, or similar from the time of this command and looking the player up.

Checking Chests

If you find a chest with tons of diamonds, you want to know who put them in! We will be using these commands:
/co i
Aliases:

• / co inspect
  
• /coreprotect inspect
  

/co l
Aliases:

• /coreprotect lookup
  
• /co lookup
  

Now to using them. Use the first command (/co i) and right click the chest you want to "inspect". You should get something like this:


This will show all chest transactions. You will most likely see some additions(+1), but this person happened not to really put much in. You might not find it on the first page, so you can look farther back just like you do to find mined blocks.
/co l

Now with this you will find out who put it in, and who you should lookup(see above)!