From: "Fuller, Jason" <JFullerat_private> To: "'forensicsat_private'" <forensicsat_private> Subject: server spool files Date sent: Wed, 20 Jun 2001 10:18:36 -0500 [ Double-click this line for list subscription options ] I am looking for any information on viewing saved spooled files under Win NT Server 4.0. The system is running Win NT Server 4.0 SP6a. The current printer setup up on the server shows 11 different printers were used on the network in question. Each printer was setup to "keep documents after they have printed" under the scheduling tab. Does anyone have info on viewing these files. The server creates two files per printed document. One is a *.spl extension and the other is a *.shd extension. I need to view these spooled files without having to re-print each document. Thank you in advance. Jason Hi Jason I'm sticking my neck out here, but I believe the .spl is the actual data sent to the printer, which will depend on the printer driver in use, and the .shd file is used for job scheduling. I wouls suggest a quick look with DiskProbe in the first instance, to see if you can find anything of interest in the binaries. Michael D. Barwise, BSc, IEng, MIIE Computer Security Awareness tel +44 (0)1442 266534 http://www.ComputerSecurityAwareness.com Addressing the Human Equation in Information Security
This archive was generated by hypermail 2b30 : Thu Jun 21 2001 - 13:20:34 PDT