You could try the .SPL and .SHD files found in %systemroot%\system32\spool\printers or unallocated space. These files show the file with complete path and printer used as well as whether it was printed in EMF or RAW format. -----Original Message----- From: Christian Schaller [mailto:christian.schallerat_private] Sent: Friday, September 20, 2002 10:45 AM To: Forensics Mailinglist Subject: Windows NT: information about printed documents Hi there, I am wondering if Windows NT provides some information about the name of the last documents printed with a certain printer (similar to recent files feature). Any clues? Thanks a lot in advance for any hints! - Chris ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Oct 08 2002 - 05:05:00 PDT