The "missing" .spl files were in all likelihood overwritten. Remember, when a file is "deleted," its entry is removed from the from the "catalog" (FAT, MFT) and the space the file occupied is marked as "available" (unallocated). So, if "Mr. Print-Happy" also moves a lot of documents, images, cached web pages, video clips, MP3s (surely not at work!!! 😯 )… etc onto and off of his hard drive, then unallocated space may be overwritten, unallocated, overwritten, unallocated and on and on many times.
Yeah this what i thought the explanation probably was, its a heavily used drive.
Given that all of these files are typically deleted and given that the normal amount found is 0, I'd say 70 is an unbelievable number to have remaining!
In my limited experience, "only those 70 sets" is a large amount.
Has anyone else ever seen numbers like this???
Really? oh well i'll think myself lucky wink .
Yeah, i knew that the spool files were usually deleted as soon as the print job finished, so any ideas why these ones aren't?
all i have to do to view them in FTK is navigate to the obvious directory, maybe FTK is pulling them back from unallocated space and placing them there in the tree but i very much doubt this as they would have an orphan sign next to their filename…