Investigating around mainframes and other high-end systems: the revenge of big iron
Normal computer forensic tools and techniques are ineffective or inefficient when applied to mainframes or other very large systems. Incidents involving mainframes are likely to have a significant business impact, so preparation is essential, both of any specialist tools and of staff with mainframe experience. Proper design of system audit logs can also provide admissible material of evidential weight, without the requirement for forensic treatment.
investigation mainframe forensic audit log