AirPrint Forensics: Recovering the Contents and Metadata of Printed Documents from iOS Devices

Algorithm 3

#!/usr/bin/perl

print "Filename,iOS version,Print date∖n";

while( $file = shift(@ARGV) ) {

 $ios = ”;

 $date = ”;

 $pdfinfo = ‘pdfinfo $file 2>&1’;

 @metadata = split( /∖n/, $pdfinfo );

 if( @metadata[] =^~ m/iPhone OS.*  Quartz PDFContext/ ) {

  ($ios = @metadata[]) =^~ s/.*iPhone OS ([-9.]+) Quartz PDFContext/iOS ∖1/;

  ($date = @metadata[]) =^~ s/CreationDate: //;

  print "$file,$ios,$date∖n";

 }  else {  print "$file,does not look like an AirPrint temporary file.∖n"; }