Forensic Job

[iolair]

I have been given the task of finding out who printed a document and the contents of that document. Is there a location on the server where a queue is written to disk before going out to the printer? If so, is it possible to recover the print job? Is it possible to see who owned the print job? Any way to track this without having all ready set it up with auditing? TIA

Iolair MacWalter
Director of IT

 

[itsp1965]

Usually Iolair when a print job is created a .spl file is generated in the spooler folder and then deleted once it prints out to a print device. Unless you have configured your print queues to keep all printed documents, you won't be able to retrieve the spooled document
If this printer comes with a management interface like some high end Xerox and HP printers, you might be able to check the logs as to what activity has been generated.
Hope this helps.

 

[58sniper]

Depending on your event log settings, you should be able to find an event when the document was printed, and by whom.

Pat Richard
Microsoft Exchange MVP

 

[grantjb]

Had the same task and I found the information required in the event viewer.

Grant

 

[iolair]

Thanks. I'm going to setup an audit event for the future, but was trying to see if there was a way to recover from that. Thanks for all the replies. It is an HP printer, and I'm going to print out the logs from that device, to see what I got there.

Iolair MacWalter
Director of IT