Who deleted the records

Question

Hi,
How can i find the user who deleted the record when auditing is not enabled in the database?

Answer 1

Perhaps something like this should work ->
select a.sid,
       a.serial#,
       a.username,
       a.ownerid,
       b.sql_text,
       a.status,
       a.schemaname,
       a.osuser,
       a.process,
       a.machine,
       a.terminal,
       a.program,
       a.type,
       a.module,
       a.logon_time,
       a.event,
       a.service_name
from (
        select sid,
               serial#,
               username,
               ownerid,
               status,
               schemaname,
               osuser,
               process,
               machine,
               terminal,
               program,
               type,
               module,
               logon_time,
               event,
               service_name,
               sql_id
       from v$session as of timestamp(sysdate - 1/1440)   -- 60/1440 indicates 1 hour before
     ) a,
        select sql_text,
               sql_id
        from (select * from v$sqltext as of timestamp(sysdate - 1/1440))
        where sql_text like '%delete from emp_n%'
     ) b
where a.sql_id = b.sql_id
and   a.schemaname = upper('scott');I personally felt that - if you are DBA then you should blame it on yourself and not to any other developer. After all, this is your mistake - no matter the developer has done it intentionally or not. It's up to you people to maintain a proper security and not by them. And, you should take responsibility. Anyway, it's your matter. And, this is my opinion.
Regards.
Satyaki De.