So, I've read that most printers save the files they print/scan and I was trying to see if that's the case with our work printers. Is there a tool to let me access these files?
Everything that I've read and news reports I've seen about this problem seems to indicate that dismantling the machine and removing the hard disk drive is the best way to get to the data. If you're doing a pen-test I'd say that it's fairly unlikely that the Customer is going to let you tear their photocopier apart.
Presumably there are vulnerabilities in many copiers' operating systems that would permit access to the hard disk drive, but it may go well beyond the level of a simple pen-test to develop software to exploit these sorts of vulnerabilities. If that's something that interests you then you may want to start investigating the various OS's and embedded platforms used in copiers, serarching for vulnerabilities, and developing exploits to get at the data. You might well be able to make a name for yourself...
At least with older Xerox printers there were a variety of Postscript operations available for interacting with the local filesystem...you could use this by submitting the appropriate print job to the printer, or possibly through an interactive
telnet session. Look at the "File operators" section in chapter 8 of the Postscript Language Reference Manual.
Of particular interest may be the
filenameforall operator, which will execute a block of code for each filename matching a pattern...this is a great way to write your own version of the
At one point I had some tools for connecting to the printer via telnet and dumping the contents of all the files (and then splitting them apart on the receiving end). I think they've been lost after some job and hardware changes, but it's definitely possible.
EDIT: Section 7.4.2 of the MIME RFC is also interesting from a security perspective w/r/t Postscript printers.