The Windows NT print spool shadow file format

Introduction

The shd file (spool shadow file) is a small file that accompanies each spooled print job. It contains the information that is used when you query a print job (with the GetJob API) and it is kept in a separate file so that this operation doesn't interfere with the spooling and despooling of a print job. The format of this file is not documented and so it is liable to change between versions of the windows operating system.

Currently it is like this:

[INT32] SpoolShadowFileFormat

This can be one of:

Public Enum SpoolShadowFileFormats
  SHD_SIGNATURE_WIN98 = &H494B
  SHD_SIGNATURE_WINNT = &H4966
  SHD_SIGNATURE_WIN2K = &H4967
  SHD_SIGNATURE_WIN2003 = &H4968
End Enum

Then for the newest two spool shadow file formats, we have:

[INT32] HeaderSize - The size of the fixed part of this record.
[INT16] Status - the job status flags.
[INT16] Padding - I'm not sure what (if anything) this is used for though it does often contain non zero values.
[INT32] JobId - the unique number of the print job, which is the JobId parameter in any call to GetJob() etc..
[INT32] Priority - A number between 1-99 which is the print job priority (higher is more priority).
[INT32] OffsetUserName - The offset of the user name that submitted the print job.
[INT32] Offset_NotifyName - Offset to the name of the user to notify when the job status changes.
[INT32] Offset_DocumentName - Offset to the document name.
[INT32] Offset_Port - Offset to the printer port name.
[INT32] Offset_PrinterName - Offset to the printer device name.
[INT32] Offset_DriverName - Offset to the printer driver name.
[INT32] Offset_DEVMODE - Offset to the DEVMODE structure in the file.
[INT32] Offset_PrintProcessorName - The offset in the file to the print processor name in the file.
[INT32] Offset_DataType - The offset in the file to the data type of the spool file...can be EMF or RAW.
[INT16] Year - The year of the date of submission of the print job.
[INT16] Month
[INT16] Day of week
[INT16] Day
[INT16] Hour
[INT16] Minute
[INT16] Second
[INT16] Millisecond
[INT32] StartTime - The start of the time window for this job.
[INT32] EndTime - The end of the time window for this job.
[INT32] SpoolFileSize - the size (in bytes) of the spool file.
[INT32] PageCount - and lastly the page count of the job.