Recovering data fro...
 
Notifications
Clear all

Recovering data from printer memory

6 Posts
5 Users
0 Likes
1,876 Views
(@digicarver)
Posts: 7
Active Member
Topic starter
 

Is there any way to forensically recover data of printed jobs directly from the printer memory?

 
Posted : 05/05/2007 4:52 pm
 ddow
(@ddow)
Posts: 278
Reputable Member
 

RAM impossible.
Off drum image, real maybe.
Built in hard drive – yup.

 
Posted : 06/05/2007 4:19 am
(@elmurado)
Posts: 29
Eminent Member
 

Is it a network printer? Logs on the server will help here-definitely on Win, linux I'm not sure-you could check that easily.

 
Posted : 11/05/2007 10:31 am
cinux
(@cinux)
Posts: 21
Eminent Member
 

Is it a network printer? Logs on the server will help here-definitely on Win, linux I'm not sure-you could check that easily.

Elmurado,
Are you talking about the Windows server event logs? If yes, I would be interested in the event ids. Is there any other log in windows which could tell me wht was printed?

 
Posted : 11/05/2007 11:01 am
(@elmurado)
Posts: 29
Eminent Member
 

This is a great free tool from MS.
http//www.microsoft.com/downloads/details.aspx?familyid=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

And here's a link to how to use it-the first link on this page is what you might want
http//www.logparser.com/Repository.htm
I've used this for giving reports to HR showing that users have been printing cookery books at work in the past!

Formats very nicely.
Otherwise for eyeballing the logs, check under the system events for print jobs. Usually event id 10 but there may be others too. Depending on what auditing you have turned on you can find out a fair amount of info.

Check here for auditing info
http//www.windowsnetworking.com/articles_tutorials/Securing-Printer-Usage-Windows-Server-2003-Part3.html

 
Posted : 14/05/2007 3:59 am
(@harshbehl)
Posts: 67
Trusted Member
 

This is a great free tool from MS.
http//www.microsoft.com/downloads/details.aspx?familyid=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

And here's a link to how to use it-the first link on this page is what you might want
http//www.logparser.com/Repository.htm
I've used this for giving reports to HR showing that users have been printing cookery books at work in the past!

Formats very nicely.
Otherwise for eyeballing the logs, check under the system events for print jobs. Usually event id 10 but there may be others too. Depending on what auditing you have turned on you can find out a fair amount of info.

Check here for auditing info
http//www.windowsnetworking.com/articles_tutorials/Securing-Printer-Usage-Windows-Server-2003-Part3.html

Hi can you explain how you used it as the link is not working now.

 
Posted : 24/08/2015 1:08 pm
Share: