Re: General ideas on researching deleted records

QEZJOBLOG, is gone for the time in question, about 10 days ago. there are
backups but it happened over 2 days so they can get 1 day for sure. the
second day there is no journaling or any sort of mimix. the RPG software is
very old and they have a problem finding someone to maintain it, however I
will suggest looking at journaling.

On Wed, May 13, 2015 at 4:04 PM, <broehmer@xxxxxxxxxxxxxxx> wrote:

> Joe,
> Can you look at QEZJOBLOG and see when and if there were any UPDDTA
> entries?
> If you suspect that was used to delete records there should be a
> QPDZDTALOG for
> any records changed or deleted.  But then if you suspect foul play then
> those also might be
> deleted to cover the perpetrator's tracks.
>
> I don't suppose you have any backups for one of the days in question?
> (Just askin' the obvious)
>
> You indicate that you might be able to identify the programs that
> update/delete records  in that
> file.  Same suggestion about QEZJOBLOG.  You might be able to identify WHO
> was using those
> programs and have a chat with the user.
>
> Bill
>
> "CONFIDENTIALITY NOTICE:  This e-mail transmission (and/or the attachments
> accompanying it) contain confidential information belonging to the sender.
>  The information is intended only for the use of the intended recipient.
> If you are not the intended recipient, you are hereby notified that any
> disclosure, copying, distribution or the taking of any action in reliance
> on the contents of the information is strictly prohibited.  Any
> unauthorized interception of this transmission is illegal under the law.
> If you have received this transmission in error, please promptly notify
> the sender by reply e-mail, and then destroy all copies of the
> transmission."
>
>
>
>
>
>
> From:   Hoteltravelfundotcom <hoteltravelfun@xxxxxxxxx>
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   05/13/2015 02:44 PM
> Subject:        General ideas on researching deleted records
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
>
>
>
> HI This is a general and long shot question.
>
> It seems we have lost 2 days of invoices from a particular file.
>
> How to research what caused this?
>
> Developers are the primary suspects of course or rather process of elim.
> while most
> devs would never do some of these I am trying to see what may have
> happened
> and how to locate any logs of these: by all means let me know if my
> thinking is completely
> wrong and how it should be looked for.
>
> MY thinking is records get deleted by a dev if there is
>
> 1.any program (rpg/cl ?)  that outputs to that file
> 2. A Cpyf to that file, overlaying blanks i guess.
> 3. command but a dltf would be halted bec logicals exist.
> 4. Upddta. this shop uses upddta a lot, not just developers. but then it
> has to be F23 and a lot of those.
>
> Thank you for any concrete info I acknowledge this is a fuzzy topic if
> this
> is fully off topic please remove.
>
> Thank you,
> Joe
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
>
>
> "CONFIDENTIALITY NOTICE:  This e-mail transmission (and/or the attachments
> accompanying it) contain confidential information belonging to the sender.
> The information is intended only for the use of the intended recipient.  If
> you are not the intended recipient, you are hereby notified that any
> disclosure, copying, distribution or the taking of any action in reliance
> on the contents of the information is strictly prohibited.  Any
> unauthorized interception of this transmission is illegal under the law.
> If you have received this transmission in error, please promptly notify the
> sender by reply e-mail, and then destroy all copies of the transmission."
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>