Anyone ever run across printer spool file where a lexmark printer is installed? I never would have thought it, but they are quite different than any other. The system in question is an XP box, and the .spl and .shd files were found in the normal location. However, the .spl file, in which the emf file is normally embedded is of a different structure. Instead of an EMF header appearing several bytes in to the file, the file starts with LEMF. I hit on about 11 EMF headers however I can get none to display properly (or at all). I've tried it manually, with FTK, and Encase and no luck. Here is the first line or so of the file:
LEMFm…$…………………X………i…d…L.e.x.m.a.r.k. .X.7.3…………….
There is no plain text anyplace else in the file. It's a big file too, 5.7mb. I don't remember ever seeing one that big.
Can you print a .spl file directly from dos? I did this some time back with an ~emf.tmp file from a 98 system spool. I suppose I'll need a lexmark printer for that which will probably set me back $9.00.
I appreciate any comments or suggestions.
Greetings,
I came across this post while looking for a way to view these very same file types (LEMF file signature).
I am analyzing a W2K system with ~25 of these printer spool files.
I cannot find any solutions (I have tried several SPL viewers, but no luck), so I was wondering if this was every solved by the original poster (or anyone else)
Any suggestion is appreciated
Thanks
Christine
As I recall in this case I did find the same printer and tried to print the files directly from the command line but it would not work. Sorry, but that's all I can remember from 5 years back,