Hi

in Oracle 8i there is a utility called LOGMINER which decodes redo log and archive log files and from there you can track database activity although not for each user but for the whole database. It also provides the statement to undo a statement, for example if you see an insert 2 days ago by user X at time 20:00 logminer will provides with a delete statement for in order to undo that insert

HTH