Logging raw data from usb printer and using print spooler

Question

I know similar question have been asked before like here and a few other places. but I want to ask something about the basic concepts.

So, i have been assigned a project i have to make a "usb logger". The main function of the project is to capture data transmitted from PC to Usb printer on the logger software so raw data of each printout can be saved into a file for logging and analysis.

I was told that i can use a third party tool like usbpcap but I suggested why dont we get directly data from print spooler. as far as i know print spooler maintains a queue of the data to be printed.

before i start working on this project i want to ask a few basic questions

1) what is raw data in this scenario ?

2) can I achieve this by getting directly from spooler or is there another way.

3) which one will require more pc resources communicating with usb port or spooler?

I just need to understand the domain completely. (i will be developing this project using C#)

Thanks

Answer 1

If what you need to do is capture the entire output in raw form, the easiest way to do that is with a port monitor. A port monitor sits between the spooler and the physical output device and writes the raw data to that device, so it's the natural place to capture such data.

What you need to do is install the Windows WDK and take a look at the sample port monitor. You should be able to use that with very few modifications. Mainly, you just need to add code to write the data to a file somewhere in addition to writing it to the printer. You also need to change all the code dealing with the registry since the sample assumes it is the default port monitor and writes to registry keys reserved for Windows.

Just be aware the version 4 print drivers (ie, Win8) do not support custom port monitors. However, Win8 still supports v3 print drivers, which should cover any printer currently out there.