iF the database is in archivelog .do a log miner you will be able to catch the culprit