±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36324
New Yesterday: 2 Visitors: 162

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

lexmark printer spool

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

gmarshall139
Senior Member
 

lexmark printer spool

Post Posted: Apr 21, 05 02:30

Anyone ever run across printer spool file where a lexmark printer is installed? I never would have thought it, but they are quite different than any other. The system in question is an XP box, and the .spl and .shd files were found in the normal location. However, the .spl file, in which the emf file is normally embedded is of a different structure. Instead of an EMF header appearing several bytes in to the file, the file starts with LEMF. I hit on about 11 EMF headers however I can get none to display properly (or at all). I've tried it manually, with FTK, and Encase and no luck. Here is the first line or so of the file:

LEMFm...$.....................X.........i...d...L.e.x.m.a.r.k. .X.7.3................

There is no plain text anyplace else in the file. It's a big file too, 5.7mb. I don't remember ever seeing one that big.

Can you print a .spl file directly from dos? I did this some time back with an ~emf.tmp file from a 98 system spool. I suppose I'll need a lexmark printer for that which will probably set me back $9.00.

I appreciate any comments or suggestions.
_________________
Greg Marshall, EnCE 
 
  

packys
Member
 

Lexmark printer spool REVISITED

Post Posted: Aug 30, 10 22:01

Greetings,
I came across this post while looking for a way to view these very same file types (LEMF file signature).
I am analyzing a W2K system with ~25 of these printer spool files.
I cannot find any solutions (I have tried several SPL viewers, but no luck), so I was wondering if this was every solved by the original poster (or anyone else)
Any suggestion is appreciated
Thanks
Christine  
 
  

gmarshall139
Senior Member
 

Re: lexmark printer spool

Post Posted: Aug 30, 10 23:28

As I recall in this case I did find the same printer and tried to print the files directly from the command line but it would not work. Sorry, but that's all I can remember from 5 years back,
_________________
Greg Marshall, EnCE 
 

Page 1 of 1