Hi All
I am busy with a case at the moment where the subject of the investigation has printed certain documents.
The strange thing is that there are no printer spool files that I have found, and no emf files (even after extensive data carving).
The PC is running XP SP2, and is used on a Novell network, and it uses Novell's iPrint for all of its print jobs. Does anyone have any experience in whether using Novell iPrint means that spl and emf files are not created by Windows when printing and some other data artefacts are created.
From the actual printer logs, I can show what files were printed, and the user who initiated the print job (the subject of the investigation), so I know that the subject definately printed the documents from her computer.
I am stumped…..any ideas would be greatly appreciated.
Your problems isn't iPrint but Windows XP. It is very rare to find valid print spooler files on an XP computer.
Have you tried searching the hard drive for EMF file headers? You may find some in unallocated space and from there can look to carve out what may be a print spooler file.
Greg is right and it gets worse from there. Your print job is not going to the Windows default printer so if there was a print spooler it would not have what you are looking for. iPrint is grabbing the print job and sending out on the network to a shared network printer which is it's purpose. The PC I am typing this on does not have a local printer and the only way I can print from it is with iPrint to a printer down the hall. There are no logs or spooler or anything. All you can do is show that user had access to the printer because their name is on the Access Control List in the server. If they are running low security the user could have printed that document from anywhere in the world because iPrint uses the internet to deliver the print job to the printer. Here are some specs;