The Windows NT print spool shadow file format

Introduction

The shd file (spool shadow file) is a small file that accompanies each spooled print job. It contains the information that is used when you query a print job (with the GetJob API) and it is kept in a separate file so that this operation doesn't interfere with the spooling and despooling of a print job. The format of this file is not documented and so it is liable to change between versions of the windows operating system.

Currently it is like this:

• [INT32] SpoolShadowFileFormat

This can be one of:

Public Enum SpoolShadowFileFormats
  SHD_SIGNATURE_WIN98 = &H494B
  SHD_SIGNATURE_WINNT = &H4966
  SHD_SIGNATURE_WIN2K = &H4967
  SHD_SIGNATURE_WIN2003 = &H4968
End Enum

Then for the newest two spool shadow file formats, we have:

• [INT32] HeaderSize - The size of the fixed part of this record.
• [INT16] Status - the job status flags.
• [INT16] Padding - I'm not sure what (if anything) this is used for though it does often contain non zero values.
• [INT32] JobId - the unique number of the print job, which is the JobId parameter in any call to GetJob() etc..
• [INT32] Priority - A number between 1-99 which is the print job priority (higher is more priority).
• [INT32] OffsetUserName - The offset of the user name that submitted the print job.
• [INT32] Offset_NotifyName - Offset to the name of the user to notify when the job status changes.
• [INT32] Offset_DocumentName - Offset to the document name.
• [INT32] Offset_Port - Offset to the printer port name.
• [INT32] Offset_PrinterName - Offset to the printer device name.
• [INT32] Offset_DriverName - Offset to the printer driver name.
• [INT32] Offset_DEVMODE - Offset to the DEVMODE structure in the file.
• [INT32] Offset_PrintProcessorName - The offset in the file to the print processor name in the file.
• [INT32] Offset_DataType - The offset in the file to the data type of the spool file...can be EMF or RAW.
• [INT16] Year - The year of the date of submission of the print job.
• [INT16] Month
• [INT16] Day of week
• [INT16] Day
• [INT16] Hour
• [INT16] Minute
• [INT16] Second
• [INT16] Millisecond
• [INT32] StartTime - The start of the time window for this job.
• [INT32] EndTime - The end of the time window for this job.
• [INT32] SpoolFileSize - the size (in bytes) of the spool file.
• [INT32] PageCount - and lastly the page count of the job.

Note that the dmCopies in this DEVMODE will hold the wrong value when the Microsoft Word multiple copies bug occurs.

Portions of this article based on www.undocprint.org/formats/winspool/shd. These portions are subject to the GNU Free Documentation License and are copyright © 2003-2005 Free Software Foundation, Inc.

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)