Re: General ideas on researching deleted records

Joe,
Can you look at QEZJOBLOG and see when and if there were any UPDDTA 
entries?
If you suspect that was used to delete records there should be a 
QPDZDTALOG for
any records changed or deleted.  But then if you suspect foul play then 
those also might be 
deleted to cover the perpetrator's tracks. 

I don't suppose you have any backups for one of the days in question? 
(Just askin' the obvious)

You indicate that you might be able to identify the programs that 
update/delete records  in that
file.  Same suggestion about QEZJOBLOG.  You might be able to identify WHO 
was using those
programs and have a chat with the user. 

Bill 

"CONFIDENTIALITY NOTICE:  This e-mail transmission (and/or the attachments 
accompanying it) contain confidential information belonging to the sender. 
 The information is intended only for the use of the intended recipient. 
If you are not the intended recipient, you are hereby notified that any 
disclosure, copying, distribution or the taking of any action in reliance 
on the contents of the information is strictly prohibited.  Any 
unauthorized interception of this transmission is illegal under the law. 
If you have received this transmission in error, please promptly notify 
the sender by reply e-mail, and then destroy all copies of the 
transmission."






From:   Hoteltravelfundotcom <hoteltravelfun@xxxxxxxxx>
To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date:   05/13/2015 02:44 PM
Subject:        General ideas on researching deleted records
Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



HI This is a general and long shot question.

It seems we have lost 2 days of invoices from a particular file.

How to research what caused this?

Developers are the primary suspects of course or rather process of elim.
while most
devs would never do some of these I am trying to see what may have 
happened
and how to locate any logs of these: by all means let me know if my
thinking is completely
wrong and how it should be looked for.

MY thinking is records get deleted by a dev if there is

1.any program (rpg/cl ?)  that outputs to that file
2. A Cpyf to that file, overlaying blanks i guess.
3. command but a dltf would be halted bec logicals exist.
4. Upddta. this shop uses upddta a lot, not just developers. but then it
has to be F23 and a lot of those.

Thank you for any concrete info I acknowledge this is a fuzzy topic if 
this
is fully off topic please remove.

Thank you,
Joe