• Printing - module for intercepting documents sent to printers
  • Setup printer spooler interception - the module sets all the printing to go through the spooler. The spooler file will be intercepted, if the shadow copying is enabled.


If a printer uses xps driver for printing, an intercepted document will automatically be recognized, and the recognized text will be appended to an event. If the spl file is intercepted, the only way to identify a printed document is to substitute the printing queue on a similar printer, using the intercepted spl file.

  • Setup printer to EMF format - if this option is enabled, the preferred spooler file format will be EMF, this format is easier for reading. Not all the OS support this version.


Simultaneous usage of all the printing modules makes interception of printed documents most efficient. To intercept a document sent to printing, File system activity and Shadow copying options must be enabled.