A data storage system writes data supplied from a host to data storage in accordance with write I/O of an owning application. A workload manager directs the processing of the supplied data in accordance with the write I/O of the owning application, provides service workload identification describing the write I/O, a storage subsystem control adds the service workload identification to record set information for the data, and a journal management system stores the record set information in a journal. The journaled information, for example, may be employed for performing forensic analysis of data corruption events or to perform security audits, etc.