Seems like column PID on most tables might be useful. It shows what application was used. You could pull out the second through fourth characters. This gets tricky since some module system codes, 03B for example, are 3 characters while others are 2. The one catch is PID gets updated every time something happens on the record. So, this could obscure how the original transaction was created.