IBM z/OS Evidence: SMF, RACF, DB2, IMS and CICS
Mainframe Forensics in SMF, RACF and Transaction Records
Mainframes still run the ledgers, reservation systems and card platforms at the center of class actions and insider cases, and few examiners can read their records. Global Digital Forensics preserves the SMF, security manager and subsystem records before the review period ages out, and shows who accessed or changed the data at issue, when, and under what authority.
Check the Mainframe Records Behind Every Finding
Before any conclusion we confirm the z/OS release, the external security manager, the subsystems and the record reading tools involved, and we match the assigned specialist to that environment. RACF, ACF2 and Top Secret differ in settings and formats, so the proposal names the environment and the expertise for your assignment instead of assuming one shop looks like another.
We validate SMF record types, subtypes and fields against the applicable IBM documentation and the audit settings in force during the review period. Type 81 records RACF initialization, and type 80 records the audited activity the configuration actually asked for, so the report rests on what the site recorded rather than what a standard installation might have recorded.
A security database unload shows its state at the moment of collection. We correlate it with retained audit and change records before reaching any historical conclusion about access or privilege, and we document the period, configuration, decoder version, exclusions and assumptions behind each finding so another mainframe examiner can check the work.
The record definitions we rely on come from IBM: SMF record type 81, the RACF initialization record, and z/OS Security Server RACF Macros and Interfaces.
If SMF records are rotating now, call (800) 868-8189 before the review period ages out, and we will tell you which record types to hold while the rest is scoped.
The engagement
Security and Audit Evidence From z/OS Systems
Global Digital Forensics is a practice founded in 1992, and its founder Joseph Caruso has worked in technology since 1980 across software development, mainframe databases, real time transaction systems and IBM mainframe environments. His work in an American Express consumer class action involved airline reservation architecture, real time transactions, mainframe databases, source code and system configuration, and his Bank One shareholder class action work involved credit card transaction and deposit systems. That is the experience we bring to your z/OS environment.
IBM Z environments hold transaction, identity, application and security evidence across logical partitions. We identify the configured SMF records, the RACF, ACF2 or Top Secret manager in use and the relevant IMS, DB2 for z/OS and CICS records, then examine the retained SMF data for the partitions in scope, compare identity exports and correlate audited subsystem activity. The report names the record types, the configuration and the coverage, giving another mainframe examiner the source detail to test each conclusion.
The practice supports insider matters, enforcement questions, breach response, security audit tooling and DB2 audit review, and independent RACF or ACF2 security assessments. Findings are written for legal, compliance and enforcement readers and carry the technical detail operators and opposing experts will ask for.
Tell us the security manager, the subsystems and the question the matter must answer, and get a free consultation; we will match the specialist and put the scope in writing.
Scope
SMF audit forensics
We examine the relevant SMF records across the scoped partitions, such as type 30 jobs and steps, type 42 storage, type 80 RACF activity, type 81 RACF initialization, type 92 file activity, DB2 types 100 through 102, type 110 CICS and type 119 TCP/IP, and the report names the exact types, subtypes and trace detail used.
RACF and ACF2 identity analysis
We examine RACF or ACF2 exports, including RACF IRRDBU00 unloads, for users, groups, connections, resource and dataset profiles and access levels, with retained audit and change sources supplying the history. Top Secret work is scoped to the actual site and a qualified specialist.
IMS and DB2 for z/OS access review
We review IMS security profiles and command audits, the DB2 SQL audit traces enabled at the site and the relevant application access records, and tie the subsystem evidence to the question being examined.
CICS transaction and terminal audit review
We examine retained CICS transaction, terminal, sign on and command records and correlate the relevant SMF type 110 information to explain the activity those records support.
Independent RACF or ACF2 security assessment
An independent security review assesses sensitive resource protection, dataset profiles, privileged users and retained changes, together with the relevant SETROPTS or GSO settings and the class descriptor table configuration, so intended protection can be compared with the manager settings actually in force.
Security audit tooling review
We review the site's security audit and administration reports and DB2 audit traces alongside the underlying records they were built from, so reviewers see how each reported finding was derived and what record supports it.
Reporting for enterprise, enforcement and compliance audiences
The written report connects the mainframe evidence to the allegation, the insider event or the enforcement question, with an explanation suited to compliance and enforcement review and the technical appendices an opposing expert will expect.
Methodology
Define, Preserve, Reconcile and Explain
Define the partitions and the audit sources
We settle the engagement, conflicts and scope, naming the logical partitions, SMF types and security manager, so preservation goes to the systems and periods your matter requires.
Preserve SMF and identity records before they rotate
We coordinate preservation of the SMF review period, the RACF or ACF2 unloads and the agreed IMS, DB2 or CICS audit exports, because mainframe retention is often measured in days.
-
Reconcile identity and subsystem activity
We reconcile SMF with identity, application audit and change management records, documenting the source differences and the time basis needed to explain the activity on one timeline.
Explain the findings in reports and testimony
We deliver the agreed report and, when the matter calls for it, deposition or trial testimony grounded in the records and the methods used to read them.
Counsel who need to brief a client before the preservation request goes to operations can get a free consultation and a technical briefing on what the records will show.
Evidence commonly examined
Mainframe Evidence We Examine
SMF records identify the retained activity for the partitions and review period in scope, while RACF IRRDBU00 unloads and ACF2 extracts supply the identity and protection configuration we compare against them. IMS security profile exports and command audits add subsystem evidence, DB2 audit trace exports are read for the record types and traces enabled at the site, and CICS transaction, terminal and sign on records reconstruct application activity. SETROPTS or GSO and class descriptor records document the protection settings, and the site's own audit tool exports give findings to test against the underlying sources.
What you can expect
Your Mainframe Findings and Supporting Records
The written report explains what the mainframe evidence shows about the matter. An SMF appendix identifies the record types and their audit coverage, a RACF or ACF2 appendix sets out the user, resource and access level evidence, and an IMS, DB2 or CICS appendix documents subsystem findings where they are in scope. Deposition and trial testimony address the report and its technical basis, and demonstratives cite the SMF records and identity exports behind each explanation.
When the mainframe evidence sits beside email, endpoint or cloud records, our computer, email and cloud forensics practice connects them on one timeline.
Frequently asked
z/OS, RACF and DB2 Record Coverage
Does the analysis use native z/OS records?
Yes. The scope covers direct SMF record examination, RACF or ACF2 database analysis and DB2 for z/OS audit review, worked from the native records and documented exports rather than a summary prepared by the producing party.
Which external security managers do you cover?
RACF is the primary coverage. ACF2 and Top Secret work is defined for the actual installation, the retained records, the supported tools and the assigned specialist, and the report identifies the manager and the methods used.
What if the site did not audit the record type the matter needs?
We identify the SMF types the site wrote and retained, then show how that coverage bears on the question. Where a needed type was not audited, the report names the gap and builds the answer from the corroborating sources that exist, which gives the case a position that holds at deposition.
Do you address DB2 for z/OS, IMS and CICS, or only RACF and SMF?
All of them. The scope can include DB2 for z/OS audit traces, IMS security profiles and CICS transaction and sign on records, with the subsystems, enabled record types and evidence reviewed identified so each conclusion stays tied to the site configuration.
How does the mainframe evidence match up with the identity and application record?
We compare retained SMF activity with RACF or ACF2 identity, IMS or DB2 audit and change records for the review period, and the report shows where they agree, where their time or coverage differs and what that means for the finding.
Free consultation
Put the Mainframe Records Behind Your Matter to Work
On the first call a senior examiner takes the z/OS release, the partition scope, the security manager and the retained review period, tells you which SMF types to hold today and outlines the examination, the specialist and the report.
The 24/7 hotline reaches an examiner directly.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .