What is the SHD file format?
An .shd file is a Windows Print Spooler shadow file - a temporary binary metadata record created by the Windows Print Spooler service (spoolsv.exe) whenever a print job is submitted. Each .shd file is paired with a .spl file of the same base name; the .spl file holds the actual spool data (EMF or RAW print stream), while .shd stores the job's descriptive metadata.
The shadow file records: print job ID, document name, submitting username, source machine name, target printer name, data type (RAW or EMF), print processor, port name, submission timestamp, page count, job priority, and security descriptor. This metadata allows the spooler to reconstruct and resume interrupted jobs after a system restart.
Both files are written to C:\Windows\System32\spool\PRINTERS\ and are normally deleted once printing completes. Orphaned .shd files left behind after a crash or hung job can cause the print queue to become stuck; deleting them (along with their paired .spl files) while the Spooler service is stopped clears the queue.
The format has been part of Windows since NT 3.1 (1993) and is officially undocumented by Microsoft, though the internal structure has been reverse-engineered and documented by the community. Forensically, .shd files are valuable because they preserve the username, document name, printer target, and precise submission timestamp even after printing completed and the files were deleted.
A version word at offset 2 identifies the Windows era: 0x0200 for Windows 2000, 0x0300 for Windows XP and later.
Security & safety
RISK: LOWSHD files are created by the Windows OS itself and pose no direct malware risk. However, they reveal sensitive metadata (usernames, document names, timestamps) and are forensically significant. Attackers with SYSTEM access who compromise the spooler can exploit SHD/SPL handling - a class of vulnerabilities known since Stuxnet era (PrintNightmare and related LNK/CPL exploits leverage the spooler folder). Users should not download or run files claiming to be SHD files from external sources.
Format details
in a nutshellPrograms that open SHD files
Windows2 apps
Microsoft Windows (Print Spooler)
Built-in SHD files are consumed internally by spoolsv.exe; there is no user-facing 'open' action. To clear stuck jobs: Stop Print Spooler service → delete SHD+SPL files → restart service.
WinHex (forensic hex editor)
Paid Open SHD file in hex editor; use the SHD template from github.com/kacos2000/WinHex_Templates to parse fields. Technical details
deep spec| Encoding | Binary (proprietary, officially undocumented by Microsoft) |
| Byte order | Little-endian |
| Magic bytes | FF FF at offset 0; version word at offset 2 (0x0200 = Windows 2000; 0x0300 = Windows XP and later) |
| Typical size | 1 KB - 16 KB (metadata only; no print data) |
| Structure | Fixed-length binary header followed by variable-length fields: job ID, printer name, document name, username, machine name, datatype, driver name, print processor, port, timestamp, page count, job priority, security descriptor |
| Paired file | Always paired with a .spl file of the same base name, which holds the actual spool data (EMF or RAW print stream) |
| Storage location | C:\Windows\System32\spool\PRINTERS\ (temporary; deleted by spooler on job completion) |
| Creating process | spoolsv.exe (Windows Print Spooler service); created on job submission, removed on completion |
| Forensic value | Records username, document name, target printer, and submission timestamp - useful for print-job attribution in digital forensics |
| Datatype field values | RAW (printer-native data) or EMF (Enhanced Metafile, device-independent format) |
| Platform | Windows NT 3.1 through Windows 11 |
| Released | Windows NT 3.1 (1993) |
| Latest version | Current across all Windows NT/10/11 versions |
| Specification | www.codeproject.com |
SHD conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about SHD files.
