1

I am attempting to find the original file that is being printed. I am aware that there is an SPL file stored in C:\Windows\System32\spool\PRINTERS that triggers the print job, but I would like to find the file used to create this spool file.

Is there a way to get the full path of the document printed using winspool or win32 API?

Daniel Quomsieh
  • 25
  • 1
  • 5

1 Answers1

1

In general, no. Only the application calling the print APIs is aware of any file involved (if any).

Nick Westgate
  • 3,088
  • 2
  • 34
  • 41
  • Is there a way to view the data being sent to the printer? With enough permissions from the client PC of course. Also since you said in general, is there a specific case where this does happen or is that reserved for those explicitly making this type of feature. – Daniel Quomsieh Apr 04 '22 at 11:14
  • 1
    Well, one specific instance is when Notepad++ prints a file: the title of the print job will be the full path of the file, including the filename. But the print system isn't aware if any particular file is being printed, just a series of print API calls (e.g. GDI); Depending on many factors the print system might spool the file as EMF or XPS or the printer's Page Description Language (PCL, PostScript etc). If you can pause the print job then that spool file data is available for you to peruse. But you said you knew about the SPL file. – Nick Westgate Apr 05 '22 at 00:20
  • Thank you for the wonderful insight. I have been attempting to gain as much information for the print API calls, but am only able to retrieve jobName, documentName, totalSize, and some other fields that have not been useful in retrieving the original content of the document. By any chance, is there a way to figure out what type of SPL file am I looking at, like a language specifier or something of the sort. – Daniel Quomsieh Apr 05 '22 at 09:20
  • 1
    @DanielQuomsieh: Yes, but it gets complicated. Look at my other print-spooler-api answers such as [this one](https://stackoverflow.com/a/65877161/313445). In particular the link to the undocprint website, which is gone but available [here](https://web.archive.org/web/20191229194244/http://www.undocprint.org/winspool). – Nick Westgate Apr 05 '22 at 20:04
  • Thank you for the answer! I always get redirected to undocprint, didn't know it was archived. I have another question, Would I be able to get the original file/datastream being printed with a print monitor? – Daniel Quomsieh Apr 06 '22 at 08:27
  • @DanielQuomsieh: No. Again, the print system isn't aware of any file (if any) involved. I think you need to write a simple app that prints something to understand that an app just calls APIs to draw lines, draw bitmaps, write text, etc. – Nick Westgate Apr 06 '22 at 12:27
  • just for clarification, is there any window's printer component that I can implement that will be able to store whatever data is being transferred from the application to the printer, without having control over the application or printer being used? And thank you again for your patience. – Daniel Quomsieh Apr 07 '22 at 08:44
  • It's been years since I looked into this, but I think the answer is yes for v3 drivers, but no (or something I haven't researched) for v4 drivers. See my answer [here](https://stackoverflow.com/a/42124626/313445). If I've answered your original question, please accept the answer with the tick button on the left under the vote buttons. – Nick Westgate Apr 07 '22 at 21:11
  • 1
    Thank you very much @Nick Westgate, you have been one of the most helpful individuals while researching this topic, I cannot thank you enough! Haha funny enough, I currently have that thread open, was researching the spooler components and redmon, until I realized it was somewhat deprecated. If it is possible, I might reach out to you for more help. – Daniel Quomsieh Apr 08 '22 at 15:42