Let's supposed somebody updates routines via %RCOPY or %RI, the really old-style hardcore way which still works. Does that leave any log traces in Journaling or system globals, as of when exactly did it happen or what was the IP address of the machine changes came from? I am aware only of the Date Modified changes as seen when opening the file.