Steve adams mentioned long time ago that is is way difficult to do. but if you are willing to dump archive logs with the right later and op code, you may be able to find it. you are running in archivelog mode right? Raj