Need help with a printer hacking idea

[irongeek at irongeek.com (Adrian Crenshaw)]

Ok,
    I've noticed the c:\Windows\System32\spool\PRINTERS folder sometimes has
SPL files in it that contain EMF versions of what is being printed (I've
attached a sample). You can find a viewer here
http://www.codeproject.com/KB/printing/EMFSpoolViewer.aspx . These normaly
get deleted as soon as the print job finishes printing. I've tried using
tools that look in the MFT, but they don't see any deleted files that match
(working on the data carve as we speak), Other than having a app that sits
there that constantly polls for new files in the spool folder, can you think
of a way to have an event fire off that will copy these jobs as they are
printed? Lot's of sensitive stuff is printed, and this could be some useful
info for pentesters/forensics guys.

Adrian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20090825/95b7668b/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: FP00003.SPL
Type: application/x-futuresplash
Size: 1136 bytes
Desc: not available
Url : http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20090825/95b7668b/attachment.spl