Print spooler files (.SPL and .SHD)

What it is

The Print Spooler service (spoolsv.exe) queues every print job on disk before sending it to the printer. Each job produces two files: a .SPL file with the page data and a .SHD shadow file with job metadata (user, document name, printer, data type). They are normally deleted as soon as the job finishes, but they are often recoverable, and when they are, the SPL can show exactly what was printed. The spooler also loads printer drivers, which made it a persistence and privilege escalation target (PrintNightmare).

Location

What it proves

• Proves a job was submitted: the SHD holds the submitting user, machine, document name, printer name and data type.
• Proves content when the SPL is recovered: EMF spool data can be rendered back into pages.
• Event 307 proves a job was printed with document name, user, printer, port, size and page count.
• It does not prove a paper copy was collected, or that the printer actually output it (offline printers, cancelled jobs).
• Print to PDF and XPS Document Writer jobs also pass through the spooler: a "print" may be a file export.

Key fields

The SHD layout differs between Windows versions and is only partly documented; parsers may misread newer variants.

Timestamps

Retention and clearing

• Spool files are deleted after a successful job. They remain if the printer is offline, the job errors, or Keep printed documents (KeepPrintedJobs attribute) is enabled on the printer.
• Deleted SPL/SHD content is frequently recoverable by carving unallocated space (look for the EMF header record, whose EMF signature sits at offset 40) and from shadow copies.
• PrintService/Operational is disabled by default; enable it (and size it up) in environments where print leaks matter.

Collection

# Spool folder and drivers (admin)
robocopy C:\Windows\System32\spool\PRINTERS E:\case\spool /COPY:DAT /DCOPY:T
robocopy C:\Windows\System32\spool\drivers E:\case\spooldrivers /E /COPY:DAT /DCOPY:T
# Is the Operational channel on, and what does it hold?
wevtutil gl Microsoft-Windows-PrintService/Operational
Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational | Where-Object Id -eq 307

Collect the SYSTEM and SOFTWARE hives and the NTFS metadata ($MFT, $J) alongside.

Parsing tools

• EMF Spool Viewer / SPLViewer (free Windows utilities): open EMF SPL files and render the pages.
• Manual carving: split EMF records out of an SPL or unallocated space with a hex editor or bulk_extractor, then view as .emf.
• EvtxECmd: event 307 maps cleanly into CSV for timelines.
• Registry Explorer: printers, ports, drivers and Point and Print policy.

Investigation tips

• Data leak: build a print timeline from event 307, USN .SPL creations and SHD remnants, then recover content from carved SPLs. Match document names to files in recent documents and jump lists.
• PrintNightmare (CVE-2021-1675 / CVE-2021-34527): look for unexpected DLLs in spool\drivers\x64\3\ and its New/Old folders, spoolsv.exe spawning processes, and PrintService events for driver installation or plug-in load failures (commonly cited: Admin 808, Operational 316; verify the IDs and channel on your build). Check HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint for NoWarningNoElevationOnInstall = 1.
• Rogue print processors and port monitors are a known persistence method: review Control\Print\Environments\...\Print Processors and Control\Print\Monitors.
• A document name like a web page title often indicates printing from a browser; pivot to browser artifacts.