How do you know a file that reside on a dvd have been printed?
Look at the metadata. See
Of course that won't tell you if it was printed from the DVD. It can only reflect if the item was printed prior to being burned to the DVD.
I think your only hope there is finding print spool files on the host. Another chance might be the printer has a disk drive that would have artifacts.
Of course that won't tell you if it was printed from the DVD. It can only reflect if the item was printed prior to being burned to the DVD.
I should have been more specific in my answer. That will teach me to throw out off-hand answers when I am in a hurry.
Hi
For right or wrong try and look (if it was recent) look for lnk files that would point to the printer, emf files in FTK these would be in your graphics tab. Also have a look at printer spools if it was recent you should find traces of the document in your recent documents.
You might be able to find something in the metadata. If you know the name of the printer then older versions of Word documents can even hold the make and model of the printer in plaintext. Depending on the way a document has been created or modified, you might find a date/time of printing, but it might not necessarily relate to the document you're looking at. Just to confuse things. )
You might be able to find something in the metadata…
Interesting thread. I'm still a bit unclear as to why some seem to think that the metadata for a file found on a DVD would be modified.
One of the issues with the metadata is that if person A gets the file, prints it, saves it, and then sends the saved copy of the file to person B, the metadata will show the last_printed date…but that will be for person A, not B.
If the file is opened in the application, then you'll see an MRU for it. On WinXP, this would be in the RecentDocs subkey, as well as the application-specific keys within the Registry. For Win7, you would find the MRU in the appropriate Jump List. However, this will show that the file was opened/accessed, but not specifically printed.
Even combining the metadata with the Jump List, at this point, will not show definitively that a specific user printed the document.
Interesting thread. I'm still a bit unclear as to why some seem to think that the metadata for a file found on a DVD would be modified.
If all you have is the DVD, the only place there would be any indication of printing is in the metadata.
That said the metadata would only show the last printing (Office 2010 keeps track of printing differently, but the question was doc, xls, etc. not docx, xlsx, etc.) that happened before the file was burned to the DVD.
If the printing happened after the file was burned to the DVD and the only item to examine is the DVD then the examiner will be out of luck.
Thanks. My point exactly.