IT Forensics – Windows
Forensic analysis of the Windows Print Spooler – Technical investigation of print jobs
Der Windows Print Spooler verwaltet Druckaufträge und erzeugt dabei verschiedene Artefakte, die Rückschlüsse auf Druckvorgänge zulassen können. Je nach Systemkonfiguration können unter anderem Informationen zu Druckern, Druckaufträgen, Zeitpunkten und temporären Spool-Dateien vorhanden sein.
Im Rahmen einer professionellen IT-forensischen Untersuchung werden diese Artefakte niemals isoliert bewertet. Erst die Korrelation mit Registry-Daten, Dateisystemartefakten, Ereignisprotokollen und weiteren digitalen Spuren ermöglicht eine belastbare technische Einordnung.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.
The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
Analysis of spool files, print queues, printer configurations and associated Windows artefacts, including full documentation of all investigative steps.
Typical areas of application
This is how the analysis works
Once a forensic image has been created, any existing spool files and associated artefacts are analysed and correlated with other Windows traces.
Warum sind Print-Spooler-Artefakte wichtig?
They can provide evidence as to whether and when documents were printed. The extent to which this evidence is reliable depends on the individual case and on the artefacts that still exist.
Frequently Asked Questions
🔗 Related topics
LanCologne – Windows Forensics in Cologne
LanCologne supports you in carrying out legally admissible analyses of Windows print artefacts and in the objective assessment of complex IT forensic cases.