User Guide / Manual

KeyGrabber TimeKeeper

inc. Mac Compatibility Pack (MCP)

KeyGrabber TimeKeeper User Guide

Introduction

About the product

The KeyGrabber TimeKeeper is a special version of the KeyGrabber USB, with an additional time-tracking module powered by an internal battery. The KeyGrabber TimeKeeper inherits all the powerful features of the USB series, adding the capability to create date and time-stamps in the log file. All TimeKeeper series devices have a huge internal flash disk, ensuring years’ worth of keystroke logging without any maintenance. Both the USB version is accessible via the Mass Storage Device technology, guaranteeing super-fast and easy data access. This hardware keylogger is 100% transparent for computer operation and no software or drivers are required.

Features

  • Internal clock and battery
  • Built-in time-stamping module
  • High-capacity internal flash memory, accessible as a USB removable drive
  • Compatible with all USB keyboards (including Linux & Mac)
  • Mac Mode ensuring full compatibility with all Apple keyboards (MCP version only)
  • Ultra fast memory contents retrieve via USB port
  • Transparent to computer operation, undetectable for security scanners
  • No software or drivers required, operating system independent
  • Memory protected with strong 128-bit encryption
  • Quick and easy keyboard layout support
  • Ultra-compact and discreet

Requirements

  • Computer with standard USB 1.1, 2.0 port
  • USB HID-compliant keyboard (Low-Speed, Full-Speed, or High-Speed)
  • Operating system with USB Mass-Storage device support

Applications

Employers:

  • Monitor acceptable internet usage
  • Monitor employee productivity
  • Detect unauthorized access attempts
  • Backup typed text
  • Collect computer usage statistics

Parents:

  • Monitor your family's computer activity
  • Protect your child from on-line hazards and predators
  • Observe WWW, E-mail, and chat usage
  • Save a copy of written documents

Investigators:

  • Monitor remote computers
  • Retrieve unknown passwords, operating system independent
  • Collect computer-related evidence
  • Detect unauthorized use of computer equipment

Quick start

This section contains concise information on basic keylogger handling. If you need detailed instructions, please refer to sections Recording keystrokes and Viewing recorded data.

To record keystrokes, plug the device in-between the keyboard and USB port.

KeyGrabber TimeKeeper - Quick start (1)

To view recorded data, plug the device in-between the keyboard and USB port, and press the 3-key combination simultaneously (by default K, B, S)

KeyGrabber TimeKeeper - Quick start (2)

The keylogger will pop up as a removable drive, containing the file LOG.TXT. This file will contain all recorded keystroke data.

KeyGrabber TimeKeeper - Quick start (3)
KeyGrabber TimeKeeper - Quick start (4)

Recording keystrokes

Installation of the KeyGrabber TimeKeeper is quick and easy. Simply plug it in between the USB keyboard and the USB port. No software or drivers are required. The USB hardware keylogger will start recording all data typed on the keyboard to the internal flash disk. Once recording starts, new data will be appended to the end of the log file. The device is completely transparent for computer operation.

Step 1. Disconnect the USB keyboard from the USB port at the computer or hub. This can be done even with the computer up and running.

Step 2. Connect the hardware USB keylogger between the USB keyboard and the USB port. Keystroke logging will start automatically.

KeyGrabber TimeKeeper - Recording keystrokes (1)

Note: If an external USB hub is being used, connect the keylogger between the hub and the USB keyboard.

Viewing recorded data

Once keystroke data has been recorded, it may be retrieved on any computer with a USB port. This is done by switching to flash drive mode. The KeyGrabber TimeKeeper and keyboard should be connected in the same way, as during normal recording.

Each device has a built-in 3-key combination (by default K, B, S). Press these 3 magic keys simultaneously to trigger flash drive mode.

KeyGrabber TimeKeeper - Viewing recorded data (1)

After a few seconds, the hardware keylogger will automatically get detected as a mass storage device. The operating system will use the standard built-in mass storage driver (MS Windows 7 in the following examples).

KeyGrabber TimeKeeper - Viewing recorded data (2)
KeyGrabber TimeKeeper - Viewing recorded data (3)

Depending on the drive letters available, the device will be visible as a new drive, for example F:. Use the systems file manager to browse this disk (for example Explorer). The keyboard will be disconnected and unavailable, so the mouse must be used to browse the disk.

KeyGrabber TimeKeeper - Viewing recorded data (4)

The removable disk will contain the file LOG.TXT with a text log of all captured data. Keystroke data is formatted in the same as it would appear on the screen, with special keys in brackets ([Ent], [Esc], [Del] etc.). This file can be viewed and searched with any text editor, such as Notepad or MS Word.

KeyGrabber TimeKeeper - Viewing recorded data (5)

During flash drive mode, the USB keyboard is inaccessible, and usually the mouse is the only operating device. Therefore it is a good idea to copy the file to the hard drive, and restore standard operation. Erasing and editing the file LOG.TXT is obsolete, because the flash disk has a huge memory worth of years of intensive typing.

Switching back to standard mode can be achieved by a safe software removal of the flash disk. Use the systems standard disk removal procedure. For MS Windows, left-click on the Safe Removal icon in the system tray and select the appropriate drive. Some systems will require to unplug the reconnect the keylogger.

Note: During the first switch to flash drive mode, the operating system can ask for drivers. In such case choose automatic driver installation (usually default option).

Note: While in flash drive mode, the USB keyboard is disabled. Use the mouse to operate the system. If mouse operation is dependent on the keyboard (i.e. wireless desktop or USB keyboard with mouse attached to it), connect the keyboard/mouse combo to a different USB port after switching to flash drive mode.

Flash drive options

Flash drive mode allows several standard examination and maintenance procedures to be performed through the operation system. The most common operations are described below with MS Windows as an example operating system.

Phrase searching

Copy the log file LOG.TXT to the hard drive and restore standard mode, by disconnecting the flash disk. Open LOG.TXT in any text editor, such as Notepad or MS Word. The entire log file may be viewed, or searched using the text editor built-in Find option (CTRL-F). To locate WWW & E-mail addresses, define the search phrase as ‘www’, ‘.com’, ‘@’ etc.

KeyGrabber TimeKeeper - Flash drive options (1)

Memory erasing

A flash disk capacity of several megabytes makes memory erasing obsolete. This is equivalent to several years’ worth of intensive typing. However, it is possible to keep the log file clean by erasing it occasionally. This can be achieved by the standard system file delete procedure while in flash drive mode. For MS Windows active the context menu for the log file and select Delete. A new log file will be created on the next power-up.

KeyGrabber TimeKeeper - Flash drive options (2)

Memory formatting

Flash disk formatting will erase all data present, including the log, configuration, and layout files. For MS Windows activate the flash drive context menu and choose Format. Make sure the correct disk is selected and check the option Quick Format.

KeyGrabber TimeKeeper - Flash drive options (3)

Disconnect and reconnect the keylogger from the USB port immediately after formatting has finished. Default settings will be restored and a new log file will be created.

Clock configuration

It is necessary to configure the built-in clock module for getting correct date and time-stamps. To do this, a text file named TIME.TXT should be prepared with the following format:

Year=2020
Month=4
Day=1
Hour=12
Minute=34
Second=56
Format=PM

AirDrive RS-232 Clock configuration

The fields should contain the current time and date. The field Format allows distinguishing between A.M., P.M., and 24-hour time (use the value AM, PM, or 24). After the file has been prepared, switch to flash drive mode and copy the file TIME.TXT to the root folder of the flash disk.

AirDrive RS-232 Clock configuration

After copying the file, safely remove the flash drive and press the button to switch back to record mode. The new clock configuration will be loaded during the next power-up.

The clock configuration file must be named TIME.TXT and must be placed in the root folder. Variable and value strings are case insensitive, however they must match the options listed below.

  • Year sets the clock year value. Valid range is from 2000 to 2099.
  • Month sets the clock month value. Valid range is from 1 (January) to 12 (December).
  • Day sets the clock day value. Valid range is from 1 to 31. If the specified day exceeds the maximum number of days in the specified month, the next valid day value will be chosen.
  • Hour sets the clock hour value. Valid range is from 1 to 12 for 12-hour time (A.M./P.M.), and 0 to 23 for 24-hour time.
  • Minute sets the clock minute value. Valid range is from 0 to 59.
  • Second sets the clock second value. Valid range is from 0 to 59.
  • Format sets the time format. Valid values are AM, PM, and 24. If AM is chosen, the 12-hour format is selected and the specified hour is treated as before noon. If PM is chosen, the 12-hour format is selected and the specified hour is treated as afternoon. If 24 is chosen, the 24-hour format is selected and the specified hour is treated as 24-hour format.

Sample TIME.TXT for 12-hour time:
Year=2020
Month=10
Day=25
Hour=5
Minute=34
Second=56
Format=PM

Sample TIME.TXT for 24-hour time:
Year=2020
Month=10
Day=25
Hour=17
Minute=34
Second=56
Format=24

Configuration options

The KeyGrabber TimeKeeper may be configured through the file CONFIG.TXT, placed in the flash drive root folder. Use any text editor to prepare such a configuration file, containing the following text:

Password=KBS
LogSpecialKeys=Medium
DisableLogging=No

Copy this file to the root folder in flash drive mode. The new configuration will be loaded on next power-up.

KeyGrabber TimeKeeper - Configuration options (1)

The following list presents the most common configuration options. All variable and value strings are case insensitive.

Password sets the 3-key combination for triggering flash drive mode. Any three-letter key combination is allowed (sequence is irrelevant). The password setting is national-layout independent. Default value is KBS.

LogSpecialKeys sets the logging level for special keys, such as Enter, Escape, F1...F12 etc. Special keys are logged in brackets, i.e. [Ent]. Allowed values are None (only text is logged), Medium (text with basic function keys are logged), and Full (text with all special keys are logged). Default value is Medium.

DisableLogging allows to disable keystroke logging, however does not affect mode switching. Allowed values are Yes (logging disabled) and No (logging enabled). Default value is No.

DisableLayout allows disabling the currently loaded layout, without having to delete the layout file. Allowed values are Yes (layout disabled) and No (layout enabled, if present). Default is No.

MacMode allows to enable/disable Mac Mode on devices with the MCP option. Mac Mode is a special mode ensuring full compatibility with all Apple keyboards. Allowed values are Yes (Mac Mode enabled) and No (Mac Mode disabled). Default value is Yes.

Encryption enables flash disk encrypting. Encryption will ensure full confidentiality of the stored data, even if the device is physically tampered with. Allowed values are Yes (encryption enabled) and No (encryption disabled). Default is No.

Important: toggling the encryption setting will format the entire flash disk. All data will be lost, including the configuration and layout files!

An example configuration file contents is shown below:

Password=SVL
LogSpecialKeys=Full
DisableLogging=Yes
MacMode=No

Mac Compatibility Pack

The Mac Compatibility Pack (MCP) is a hardware enhancement ensuring full compatibility with Apple Mac computers and keyboards. Several Apple keyboards are USB High-Speed and Low-Speed combos, creating a challenge for all types of USB keyloggers. The aluminum Apple A1243 and A1242 are typical examples:

KeyGrabber TimeKeeper - Mac Compatibility Pack

The KeyGrabber TimeKeeper with the Mac Compatibility Pack features a special Mac Mode (enabled by default), which will convert the keystroke data stream to USB Full-Speed, ensuring proper operation of the keyboard and logging of all keystrokes. Mac Mode is compatible with standard keyboards too, so the KeyGrabber does not have to be reconfigured.

When enabled, Mac Mode will add an additional pass-through USB hub to the system. If this is undesired, Mac Mode can always be disabled, restoring normal operation. To disable Mac Mode, open the configuration file CONFIG.TXT (see section Configuration options) and add the following entry:

MacMode=No

Keyboard layouts

It is possible to enable a national layout for language-adapted keyboards, such as French, German etc. This will allow national characters to get logged properly (including those with Alt Gr), such as ö, æ, ß, ó etc. The following example demonstrates the advantages of applying the German national layout.

Text logged without layout
Kezlogger )PS-2 / USB=

Text logged with layout
KeyLogger (PS/2 & USB)

To enable a keyboard layout, the appropriate layout file named LAYOUT.USB must be placed on the flash disks root folder. The file must be copied in flash drive mode. Layout files may be obtained from the CD-ROM attached with the device.

KeyGrabber TimeKeeper - National keyboard layouts (1)

To enable the layout, safely remove the flash disk. On power-up, the layout file will be loaded automatically.

Specifications

Power supply

4.5 V – 5.5 V DC (drawn from the USB port)

Max. power consumption

65 mA (0.33 W)

Maximum burst log speed (approx.)

500 byte/s

Maximum continuous log speed (approx.)

100 byte/s

Data retention

100 years

Keyboard support

USB HID-compatible keyboard (Low-speed, Full-speed, High-speed)

Maximum log read speed

150 kB/s

Dimensions inc. connectors (L x W x H)

53 mm x 20 mm x 12 mm (2.1" x 0.8" x 0.5")

Troubleshooting

The KeyGrabber TimeKeeper will not work with the following hardware configurations:

  1. Internal laptop keyboards
  2. Bluetooth keyboards
  3. USB-PS/2 and PS/2-USB adapters
  4. Non-conformant USB keyboards

The keyboard is not responding

The keyboard connector or the keylogger connector is not inserted firmly. Please check the connection with the USB keyboard and port.

The keylogger does not switch to flash drive mode

Please check the following:

  1. Is the keylogger inserted between the keyboard and the keyboard port on the PC or hub?
  2. Is your 3-key combination correct?
  3. Are you pressing the 3 keys simultaneously? The 3-key combination will not be accepted if pressed sequentially.

Problems with logging national characters

Please check if you have downloaded the correct layout file and copied it to the flash disk root directory? If not, please check the National keyboard layouts section.

The keyboard doesn’t work in flash drive mode

This is normal behavior. In flash drive mode, the keylogger will install the removable disk instead of the keyboard. Use the mouse to copy the log file to the hard drive, then restore normal operation. Alternatively, you may connect the keyboard to a different USB port after switching to flash drive mode.

The mouse and keyboard don’t work in flash drive mode

This can happen on wireless keyboards and keyboard/mouse combos. In flash drive mode, the keylogger will install the removable disk instead of the keyboard/mouse combo. To get around this, connect the keyboard/mouse to a different USB port after switching to flash drive mode.

I’ve checked everything, nothing helps!

If you are still experiencing problems, please do the following:

  1. Check if the problem appears on a different keyboard.
  2. Check if the problem appears on a different computer.
  3. Contact the dealer you have purchased the device from. Please supply all necessary information (keyboard model and manufacturer, OS type and version, and a short description of the problem).

List of special keys

[Esc] - Escape
[F1] - F1
[F2] - F2
[F3] - F3
[F4] - F4
[F5] - F5
[F6] - F6
[F7] - F7
[F8] - F8
[F9] - F9
[F10] - F10
[F11] - F11
[F12] - F12
[Ctl] - Control
[Alt] - Alt
[Ins] - Insert
[Hom] - Home
[PUp] - Page Up
[PDn] - Page Down
[Del] - Delete
[Win] - Win
[Aps] - Apps
[Cap] - Caps Lock
[Ent] - Enter
[Bck] - Backspace
[Tab] - Tab

[Prn] - Print Screen
[End] - End
[Scr] - Scroll Lock
[Up] - Up
[Dwn] - Down
[Lft] - Left
[Rgh] - Right
[Num] - Num Lock
[-N] - - (num)
[+N] - + (num)
[.N] - . / Delete (num)
[/N] - / (num)
[*N] - * (num)
[0N] - 0 / Insert (num)
[1N] - 1 / End (num)
[2N] - 2 / Down (num)
[3N] - 3 / Page Down (num)
[4N] - 4 / Left(num)
[5N] - 5 (num)
[6N] - 6 / Right (num)
[7N] - 7 / Home (num)
[8N] - 8 / Up (num)
[9N] - 9 / Page Up (num)
[Pwr] - Power
[Slp] - Sleep
[Wke] - Wake

Legal disclaimer

No responsibility is taken for any damage, harm or legal actions caused by misuse of this product. The user should follow the guidelines contained in this document, otherwise no liability will be assumed. It is the user's responsibility to obey all effective laws in his/her country, which may prohibit usage of this product.

In most countries the usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.

Disposal of electronic waste

In accordance with the requirements of the directive on Waste of Electrical and Electronic Equipment (WEEE), ensure that at end-of life you separate this product from other waste and deliver to the WEEE collection system in your country for recycling.

Information on waste equipment collection points can be found on municipal office official websites and notice boards. If in doubt, please contact the direct seller of your device or us directly using the contact section.

Households play a key role in the reuse, recovery, and recycling of electrical and electronic equipment. By proper disposing of this device at the end of its life you are contributing to a cleaner natural environment.

Waste of Electrical and Electronic Equipment (WEEE)