Windows Spool Files

Warning While you might use the informations you find here to extract EMF and other data from the Windows spoolfiles, you should remember, that this informations is undocumented and might change without prior notice!

"You can probably locate the information about the EMF structs in 
the spool file format. But note that one major caveat with this 
approach is that since the spool file format is MS proprietary, it 
might change in future releases without notice. So if your driver 
is dependent on a particular spool file format, it could break on 
future releases. This is the reason for us recommending that you 
not rely on the spool file format."
//Ashwin, Microsoft

For each print job there are two spool files generated by the Windows NT/2000 spooler. One file with the .SHD extension for job settings, and one with the .SPL extension for the drawing commands.

• EMF Microsoft® Enhanced Metafile Format
• SPL Microsoft® Windows Spool File Format
• SHD Microsoft® Windows Shadow File Format

You can set “Keep Printed Documents” via registry, instead of using the printer control panel. Information about this on the Windows Spooler Registry page.

The maximum size of a printjob on Windows is 4 gigabyte. Jobs that are bigger just drop the page data without any errors. It seems like the spooler just wraps around the internal spool data size counter, when reaching the maximum32bit value.

This size will be further limited if the disk does not have enough free space to store the spool file. When the spool file runs the disk out of space the printer often finishes the job by printing blank pages. No errors are recorded.

Access to the data of a SPL spool file, can be implemented quite easily from within a print processor.

To access the spool stream use the OpenPrinter function, where you specify “PrinterName,Job xxxx” for the pPrinterName parameter. The returned hPrinter handle can be used to read the job data via the ReadPrinter function.

If the printername is "Lexmark W820" and the JobId is 3, the string to be used would be "Lexmark W820,Job 3"

For more information on this see the SDK documentation for OpenPrinter and ReadPrinter.

Information about the SPL file format can be found here: SPL Files.

Comment by Microsoft:

I checked with our developers to find out if there is any change 
in behavior as far as spooling of file is concerned in XP compared 
to that of Win 2000. The change in XP is that it clears the spooled 
file after sending the file to the printer. On the other hand in 
Win 2000, the file is kept until the printer prints the file. For 
this reason you are getting garbage reading in XP, but as you 
mentioned that if you choose to keep the document in the spooler 
"Keep printed document" in the Printer properties, it works. 

This is a design change in XP behavior, not a bug.

Though the documents does not say that ReadPrinter should not be 
called from the driver, the actual use of ReadPrinter is in the 
print processor. Relying on reading the spooled file may cause 
problem in later OSes. But developers still read the spooled file 
to get specific information. The change in behavior in XP and Win 
2003 caused problem to some third party print management programs. 

The following article describes the problem you are seeing and 
provides suggested workarounds:
http://support.microsoft.com/default.aspx?scid=kb;en-us;815913
Third-Party Print Management Program Does Not Work as Expected 
After You Upgrade to Windows Server 2003 or Windows XP

In addition to the two workarounds you found, this article has 
another workaround of creating and setting the 
DisableServerFilePooling in 
HKLM/System/CurrentControlSet/Control/Print reg_dword with 
value greater than zero.

Comment by Christoph:

Contrary to Microsoft´s statement, that "ReadPrinter should not be 
called from the driver", tests have showed, that it is possible to 
use ReadPrinter from a printer driver. Only the ReadPrinter calls 
should be done from DrvStartDoc. Remember to call 
RevertToPrinterSelf!

On Windows NT/2000 find the files by name xxxxx.spl where xxxxx was the JobID returned by the EnumJobs API.

However, XP and 2003 create spool files named FPnnnnn.spl where nnnnn is no longer the JobID.

This is the side effect of file pooling. You can “turn off” Spool File Pooling by keeping printed jobs or specify a different spool directory. The workaround to this is as below:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate the following registry subkey, where <printername> is the name of your printer: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\<printername>
3. In the right pane, right-click SpoolDirectory, and then click Modify.
4. In the Value data box, type the location where you want the spool files to be stored. For example, type c:\windows\system32\spool\printers as the default location.
5. Quit Registry Editor.
6. Restart the Print Spooler service.

All new jobs will be of the form XXXXX.SPL and XXXXX.SHD and will be numbered consistently with their JobIDs.

Note: This method only works on Windows 2003 Server. This method does not work for Windows XP.

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print
3. On the Edit menu, point to New, and then click DWORD Value.
4. In the New Value #1 box, type DisableServerFilePooling, and then press ENTER.
5. Right-click DisableServerFilePooling, and then click Modify.
6. In the Value data box, type 1 to turn off spool file pooling, and then click OK.
7. Quit Registry Editor.
8. Restart the Print Spooler service.

All new jobs will be of the form XXXXX.SPL and XXXXX.SHD and will be numbered consistently with their JobIDs.

A Print Processor must support the RAW data type or it simply won’t work. Beyond that, the data types it supports have little effect.

The decision on whether to spool EMF or RAW is made by GDI based on various factors.

Here are some of the factors:

Firstly, if the app uses the print APIs directly, it can specify whatever datatype it wants. But if the app prints through GDI:

We’ll go RAW in the following cases:

• Printing to FILE:
• Printing directly to port (no spooling)
• Client disables “advanced printing features” in printer properties.
• Some drivers always print RAW, regardless of all other options. e.g. “HP LaserJet 4100 PCL 6” from HP Homepage
• Acrobat Reader prints PDFs to printers with a postscript driver as RAW postscript files.

Additionally, for networking printing:

• Client is anything other than NT/Win200/XP
• Client doesn’t use a “true” connection
• Printing to a “masq” printer (win9x, netware, etc.)
• Server has “printer attribute RAW only” bit set
• Server doesn’t accept client’s EMF version

So there is no real guarantee that you will get on particular datatype or the other.

Make sure the PRINTER_ATTRIBUTE_DIRECT and PRINTER_ATTRIBUTE_RAW_ONLY attributes are not set for the printer.