I am currently examining a Windows Vista drive and am trying to locate the location of the registry key that shows whether the Print Spooler is turned on or the printer is set to Print to printer.
I have searched numerous well regarded information sources and have not been able to locate what is required. There is some information regarding the printer attributes but I have found this to be incorrect and unreliable.
I have tested, using a live machine and find that no matter what the computer is set to, print ot spooler or print to printer, the values do not change. I reboot the machine each time I change the setting but cannot find any changes in the registry. The values are set to either a 0, 1, or 2.
Can someone, if possible point me in the direction of where I can find the key relating to the Print Spooler.
I have attempted to restore the drive to examine the actual settings but for some reason I cannot get the drive to boot and bring up the OS. The drive is from an ACER computer.
Cheers
If I may ?
1) WHICH "well regarded information" sources?
2) WHICH specific registry key/setting did you experiment with?
3) And, more than that, WHAT is the reason to check that setting?
(or if you prefer, what would you expect to document/find out knowing if the printer spooler was on or off at the time the disk image was taken?)
I mean you either can find one or more of these (mythical) .spl files (as "proper" files or by carving unallocated space) or you don't, JFYI, though NOT what you asked
http//www.forensicfocus.com/Forums/viewtopic/t=5565/
http//www.forensicfocus.com/Forums/viewtopic/p=6538990/#6538990
particularly
http//www.forensicfocus.com/Forums/viewtopic/p=6535381/#6535381
More along the lines of your question
http//
jaclaz