Print Jobs
Overview
Section titled “Overview”Evidence: Print Jobs
Description: Collect print job info
Category: System
Platform: macos
Short Name: prntjb
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”CUPS print job history records document printing activities on macOS. This data is essential for auditing data exfiltration attempts and user activity.
Data Collected
Section titled “Data Collected”This collector gathers structured data about print jobs.
Print Jobs Data
Section titled “Print Jobs Data”| Field | Description | Example |
|---|---|---|
Title | Title | Example value |
Destination | Destination | Example value |
User | User | Example value |
Format | Format | Example value |
Size | Size | 123 |
CompletedTime | Completed Time | 2023-10-15 14:30:25+03:00 |
ProcessingTime | Processing Time | 2023-10-15 14:30:25+03:00 |
CreationTime | Creation Time | 2023-10-15 14:30:25+03:00 |
Collection Method
Section titled “Collection Method”This collector queries the cups_jobs table via osquery and records results into print_job_info.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it can indicate sensitive documents printed or unusual printing behavior.