3

In many Windows setups, when you print directly to a printer, two files are typically created in the windows spool directory "C:\Windows\System32\spool\PRINTERS". A spool file "80021.SPL" and a shadow file "80021.SHD" are examples of these files. The spool file contains the meat and potatoes of the drawing instructions so the printer can print the page. The data in this spool file comes in a smorgasbord of different formats depending on the language technology and the print driver used. However, when you are printing to a printer that's on a print server, a single ".TMP" file is created instead and gets transmitted to the print server. I think its fair to assume that this is just the .SHD and .SPL files combined into a single transport file to get it to the server. However, its unreadable, i'm nto sure if its zipped, encrypted, or what, but I can't decipher it. When printing PDFs you can typically see plain text PostScript instructions in the spool file (.SPL), by just opening it and viewing it in a text editor. You can even send that spool file (.SPL) to a postscript viewer like GhostScript and have it show you the pages drawn on screen. But when the job is all packaged up in a .TMP file, its basically just a binary pile of bits. Does anyone know how to uncompress the data from these transport .TMP spool files?

Ultratrunks
  • 2,464
  • 5
  • 28
  • 48
  • I know it's a little late in the day, but were you ultimately able to find a solution? – Harsh Pandey Jul 14 '16 at 14:43
  • @HarshPandey, not along this path I wasn't. Drivers are very particular in how they write data locally to the drive. Only a very small percentage of drivers I've came across even write their spool data in completion to the disk. And on top of that there are like a dozen competing spool file formats. EMF, PCL(tons of versions), PostScript, etc. The best way to catch it if you want to look at it is to catch it coming out on the network. Port 9100 for RAW format, and you can look up whatever port it is for the other LPR format. – Ultratrunks Jul 16 '16 at 09:53

1 Answers1

-1

I believe that file you have will be an EMF file that is padded with a proprietary MS structure at the beginning. Easiest way to find out if you are dealing with an EMF structure is to look for the ANSI characters ' EMF' in tmp file you have.

Assuming that you do find these characters it is just a matter of removing the proprietary structure data from the beginning of the file then treating it as a standard EMF file. Fortunately all EMF files have a standard header format so it should be reasonably to determine where the EMF file starts.

There is a good description of EMF file headers here

BBoy
  • 1,063
  • 1
  • 10
  • 21
  • I'm pretty sure this is not the case. I have made an EMF parser that works and it can't make heads or tails of these files. I'm pretty sure its a combination of the .SHD and the .SPL files and quite possibly encrypted for transport to the print server. But I'm not positive. – Ultratrunks May 23 '12 at 18:49
  • 1
    @Ultratrunks: I think you may have misunderstood my post. An EMF parser will not be able to open the file until you remove the rubbish from the beginning of the file. Examine the tmp file and find the EMF header, then delete everything prior to the start of the header. – BBoy May 23 '12 at 22:35
  • @Ultratrunks: Why don't you just look up the exact settings of your printer queue? It's all to be found in the 'properties' of the queue. Look on the 'advanced' tab to find the exact spool format used; be aware it may be set to a value that is not the default one. But very likely it will be a variant of EMF. – Kurt Pfeifle May 27 '12 at 21:59
  • Windows spool files are **not** just plain EMF with some header info. Yes, they're very close, but there are significant differences. Try parsing a spool file from a multi-page document with varying page layouts and you'll find that out. – Carey Gregory Oct 29 '16 at 00:56