Given that you observed the very large file in a Query PRocess
inspection, you then have a timeframe for it, which would facilitate
bracketing contributing ingredients.  In particular, from the Activity
Log you know what volumes were active at the time... If collocation is
active (usual case), then you can probably quickly identify the node
by performing Query CONtent <Volname> COUnt=1, and survey the
population of the volume by like 'Query CONtent <Volname>
Format=Detailed > /tmp/volsurvay'.  Query CONtent is not onerous, as a
Select on the CONTENTS table is.

    Richard Sims