KeeLog KeyGrabber TimeKeeper User manual
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
2
Table of contents
Table of contents......................................................................................................................2
Getting started..........................................................................................................................2
Introduction ..............................................................................................................................3
About the product .................................................................................................................3
Features ...............................................................................................................................3
Requirements .......................................................................................................................3
Applications ..........................................................................................................................4
Quick Start ...............................................................................................................................5
Recording keystrokes...............................................................................................................7
Viewing recorded data..............................................................................................................8
Flash Drive mode..................................................................................................................8
Text Menu mode (PS/2 version only)..................................................................................10
Clock configuration................................................................................................................. 11
Configuration files...................................................................................................................13
CONFIG.TXT......................................................................................................................14
TIME.TXT ...........................................................................................................................15
Mac Compatibility Pack (USB version only) ...........................................................................16
National keyboard layouts......................................................................................................17
Using KL Tools....................................................................................................................... 18
Specifications......................................................................................................................... 19
Troubleshooting...................................................................................................................... 20
List of special keys.................................................................................................................22
Legal disclaimer .....................................................................................................................23
Getting started
Already familiar with KeyGrabber keyloggers?
Start key-logging in 3 simple steps: section Quick Start
New to KeyGrabber hardware keyloggers?
Learn about keystroke recording first: section Recording keystrokes
Then learn to retrieve the recorded data: section Viewing recorded data
Finally, configure the internal clock: section Clock configuration
Questions or problems?
Go through the Troubleshooting section.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
3
Introduction
About the product
The KeyGrabber TimeKeeper is a special version of the KeyGrabber USB and KeyGrabber
PS/2, with an additional time-tracking module powered by an internal battery. The
KeyGrabber TimeKeeper inherits all the powerful features of the USB and PS/2 series, adding
the capability to create date and time-stamps in the log file. All TimeKeeper series devices
have a huge 2 Gigabyte flash disk, ensuring years’ worth of keystroke logging without any
maintenance. Both the USB and PS/2 versions are accessible via the Mass Storage Device
technology, guaranteeing super-fast and easy data access. This hardware keylogger is 100%
transparent for computer operation and no software or drivers are required.
Features
Internal clock and battery with over 7 years lifetime guaranteed
Built-in time-stamping module
Huge 2 GB memory capacity, organized as a flash file system
Compatible with all USB and PS/2 keyboards (including Linux & Mac)
Mac Mode ensuring full compatibility with Apple keyboards (MCP version only)
Ultra fast memory contents retrieve through USB
Transparent to computer operation, undetectable for security scanners
Memory protected with strong 128-bit encryption
Quick and easy national layout support
Flash Drive mode available both in USB and PS/2 versions
Ultra compact and discrete, less than 2 inches (5 cm) long
Complete functionality of the KeyGrabber USB or KeyGrabber PS/2
Requirements
Compatible keyboard:
USB version: USB HID-compliant keyboard (Low-Speed, Full-Speed, or High-Speed)
PS/2 version: PS/2 compliant keyboard
Computer with USB Mass-Storage device support
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
4
Applications
Employers:
Monitor acceptable internet usage
Monitor employee productivity
Detect unauthorized access attempts
Backup typed text
Collect computer usage statistics
Parents:
Monitor your family's computer activity
Protect your child from on-line hazards and predators
Observe WWW, E-mail, and chat usage
Save a copy of written documents
Investigators:
Monitor remote computers
Retrieve unknown passwords, operating system independent
Collect computer-related evidence
Detect unauthorized use of computer equipment
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
5
Quick Start
This section assumes you are already familiar with basic hardware keylogger handling, such
as recording and retrieving data. If you need detailed instructions, please refer to sections
Recording keystrokes and Viewing recorded data.
To record keystrokes, plug the device in-between the keyboard and USB or PS/2 port.
USB version
PS/2 version
Plug the USB keylogger in-between the
keyboard and USB port.
Plug the PS/2 keylogger in-between the
keyboard and PS/2 port.
To view recorded data using the USB version, plug the device in-between the keyboard
and USB port, and then press the 3-key combination simultaneously (by default K, B, S)
The keylogger will pop-up as a removable drive, containing the file LOG.TXT. This file will
contain all recorded keystroke data.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
6
To view recorded data using the PS/2 version, plug the device in-between the keyboard
and PS/2 port, and open a text editor (such as Notepad). Then press the 3-key combination
simultaneously (by default K, B, D)
A text menu will pop up, showing available options. Use the text menu to browse recorded
keystroke data.
Alternatively, to gain instant access to the entire log, connect the keylogger to a USB port
using the USB Download Accelerator.
The keylogger will pop-up as a removable drive, containing the file LOG.TXT. This file will
contain all recorded keystroke data.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
7
Recording keystrokes
Recording mode is the default mode of operation for the KeyGrabber TimeKeeper keylogger.
In record mode, the device will silently monitor all keystrokes coming from the keyboard and
store them on the internal Flash Drive in file LOG.TXT.
Installation of the keylogger in record mode is quick and easy, no software or drivers are
required. Simply plug it in between the keyboard plug and keyboard port. Recording will start
automatically on power-up.
USB version
PS/2 version
Plug the USB keylogger in-between the
keyboard and USB port.
Plug the PS/2 keylogger in-between the
keyboard and PS/2 port.
Note: If an external hub is being used, connect the keylogger between the hub and the USB
keyboard.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
8
Viewing recorded data
Once keystroke data has been recorded, it may be accessed directly by switching to Flash
Drive mode. The PS/2 version has an additional option of displaying a text menu, described in
section Text Menu mode.
Flash Drive mode
The primary method for viewing recorded data is Flash Drive mode. The keylogger will act as
a mass-storage device and pop-up as a removable drive. Follow the instructions below.
USB version
PS/2 version
Plug the USB keylogger in-between the
keyboard and USB port...
...and press the 3-key combination
simultaneously (by default K, B, S).
Use the supplied USB Download
Accelerator...
...and connect the device to a USB port.
After a few seconds, the hardware keylogger will automatically get detected as a mass
storage device. The operating system will use the standard built-in mass storage driver (MS
Windows 7 in the following examples).
Note: During the first switch to Flash Drive mode, the operating system can ask for drivers. In
such case choose automatic driver installation (usually default option).
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
9
The Flash Drive will contain the file LOG.TXT with a text log of all captured data. Keystroke
data is formatted in the same as it would appear on the screen, with special keys in brackets
([Ent], [Esc], [Del] etc.). This file can be viewed and searched with any text editor, such as
Notepad or MS Word.
Switching back to record mode can be achieved by a safe software removal of the flash disk.
Use the systems standard disk removal procedure. For MS Windows, left-click on the Safe
Removal icon in the system tray and select the appropriate drive.
For additional information, refer to the KeyGrabber USB User’s Guide and the
KeyGrabber PS/2 User’s Guide.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
10
Text Menu mode (PS/2 version only)
The PS/2 version features an alternative approach for memory viewing called Text Menu
mode. This mode does not require unplugging the device from the PS/2 keyboard, however is
a lot slower than Flash Drive mode. To enable Text Menu mode, the keylogger and PS/2
keyboard should be connected in the same way, as in record mode. A text editor is required,
such as Notepad.
Run the text editor and make it the active
application.
Press the 3-key combination simultaneously
(by default K, B, D)
The keylogger responds by simulating the PS/2 keyboard and will display a text-menu in the
editor window.
The displayed main menu shows a summary of memory usage in bytes and pages. The text
menu offers a variety of view, search, and configuration options. Use the digit keys to browse
around the menu.
Note: do not change the active application while in text-menu mode.
For additional information, refer to the KeyGrabber PS/2 User’s Guide.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
11
Clock configuration
It is necessary to configure the built-in clock module for getting correct date and time-stamps.
To do this, a text file named TIME.TXT should be prepared with the following format:
Year=2010
Month=4
Day=1
Hour=12
Minute=34
Second=56
Format=PM
The fields should contain the current time and date. The field Format allows distinguishing
between A.M., P.M., and 24-hour time (use the value AM, PM, or 24). After the file has been
prepared, switch to Flash Drive mode and copy the file TIME.TXT to the root folder of the
flash disk. For the PS/2 version, the USB Download Accelerator has to be used to switch to
Flash Drive mode.
After copying the file, safely remove the Flash Drive. The new clock configuration will be
loaded during the next power-up.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
12
The clock configuration file must be named TIME.TXT and must be placed in the root folder.
Variable and value strings are case insensitive, however they must match the options listed
below.
Year sets the clock year value. Valid range is from 2000 to 2099.
Month sets the clock month value. Valid range is from 1 (January) to 12 (December).
Day sets the clock day value. Valid range is from 1 to 31. If the specified day exceeds
the maximum number of days in the specified month, the next valid day value will be
chosen.
Hour sets the clock hour value. Valid range is from 1 to 12 for 12-hour time
(A.M./P.M.), and 0 to 23 for 24-hour time.
Minute sets the clock minute value. Valid range is from 0 to 59.
Second sets the clock second value. Valid range is from 0 to 59.
Format sets the time format. Valid values are AM, PM, and 24. If AM is chosen, the 12-
hour format is selected and the specified hour is treated as before noon. If PM is
chosen, the 12-hour format is selected and the specified hour is treated as after noon.
If 24 is chosen, the 24-hour format is selected and the specified hour is treated as 24-
hour format.
Sample TIME.TXT for 12-hour time:
Year=2010
Month=10
Day=25
Hour=5
Minute=51
Second=43
Format=PM
Sample TIME.TXT for 24-hour time:
Year=2010
Month=10
Day=25
Hour=17
Minute=51
Second=43
Format=24
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
13
Configuration files
The KeyGrabber TimeKeeper is configured via two text files placed on the internal Flash
Drive:
CONFIG.TXT (configures key-logging parameters)
TIME.TXT (configures the internal clock for time-stamping)
These files should contain configuration parameters, placed in successive lines in the
following format:
Parameter1=Value
Parameter2=Value
Parameter3=Value
…
Example of CONFIG.TXT
Password=SVL
LogSpecialKeys=Full
Language=English
These configuration files must be placed in the device internal memory using Flash Drive
mode.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
14
CONFIG.TXT
The file CONFIG.TXT is responsible for configuring keystroke-logging parameters.
Basic parameter list
Parameter
Values
Example
Description
Password
3-character password
(default KBS or KBD)
Password=SVL
Three-character key combination for
activating Flash Drive / Text Menu
modes.
LogSpecialKeys
None
Medium (default)
Full
LogSpecialKeys=Full
Special key logging level.
DisableLogging
Yes
No (default)
DisableLogging=Yes
Keystroke logging disable flag.
DisableLayout
Yes
No (default)
Menu
DisableLayout=Yes
National layout disable flag (see
section National keyboard layouts).
Timestamping
Yes (default)
No
Timestamping=No
Time-stamping disable flag.
DisableUsb
Yes
No (default)
DisableUsb=Yes
USB Flash Drive mode disable flag
(PS/2 version only).
Language
English (default)
Deutsch
Espanol
Francais
Language=Espanol
Text menu language (PS/2 version
only).
MacMode
Yes (default)
No
MacMode=No
Mac Mode enable flag. Available only
on devices with MCP (USB version
only).
Advanced parameter list (use only when you know what you’re doing!)
Parameter
Values
Example
Description
Encryption
Yes
No (default)
Encryption=No
Flash drive encryption setting
(caution: changing this value will re-
format the flash drive).
SupportReportProtocol
Yes
No (default)
SupportReportProtocol
=No
Report protocol support flag (USB
version only).
CheckShortFrame
No
Low (default)
Medium
High
CheckShortFrame=No
Short frame fast filter option (USB
version only).
CheckModifierByte
Yes (default)
No
CheckModifierByte=No
Modifier byte check flag (USB version
only).
FrameFilter
Filter value
(range 0…255,
default 98)
FrameFilter=226
Frame filter value (USB version only).
KeyboardSpeed
Auto (default)
Full
Low
Mixed
KeyboardSpeed=Auto
USB keyboard speed setting (USB
version only).
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
15
CheckOverflow
Yes
No (default)
CheckOverflow=Yes
Overflow check flag (USB version
only).
KeystrokeSpeed
Slow
Medium (default)
Fast
KeystrokeSpeed=Slow
Keystroke generation speed (PS/2
version only).
DisableMenu
Yes
No (default)
DisableMenu=Yes
Text menu disable flag (PS/2 version
only).
TIME.TXT
The file TIME.TXT is responsible for configuring the built-in real-time clock.
Parameter list
Parameter
Values
Example
Description
Year
Year value
(range 2000…2099, default 2010)
Year=2010
Year setting (range 2000 to 2099).
Month
Month value
(range 1…12, default 1)
Month=10
Month setting (1 is January, 12 is
December).
Day
Day value
(range 1…31, default 1)
Day=15
Day setting (range 1 to 31).
Hour
Hour value
(range 1…12 or 0…23, default 1)
Hour=6
Hour setting (range 1 to 12 for A.M./P.M.
format and 0 to 23 for 24-hour time).
Minute
Minute value
(range 0…59, default 0)
Minute=37
Minute setting (range 0 to 59).
Second
Second value
(range 0…59, default 0)
Second=49
Second setting (range 0 to 59).
Format
AM
PM (default)
24
Format=24
Time format setting. If AM is chosen, the
12-hour format is selected and the
specified hour is treated as before noon.
If PM is chosen, the 12-hour format is
selected and the specified hour is treated
as after noon. If 24 is chosen, the 24-
hour format is selected and the specified
hour is treated as 24-hour format.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
16
Mac Compatibility Pack (USB version only)
The Mac Compatibility Pack (MCP) is a hardware enhancement ensuring full compatibility
with Apple Mac computers and keyboards. Several Apple keyboards are USB High-Speed
and Low-Speed combos, creating a challenge for all types of USB keyloggers. The aluminum
Apple A1243 and A1242 are typical examples:
The KeyGrabber TimeKeeper with the Mac Compatibility Pack features a special Mac Mode
(enabled by default), which will convert the keystroke data stream to USB Full-Speed,
ensuring proper operation of the keyboard and logging of all keystrokes. Mac Mode is
compatible with standard keyboards too, so the KeyGrabber does not have to be
reconfigured.
When enabled, Mac Mode will add an additional pass-through USB hub to the system. If this
is undesired, Mac Mode can always be disabled, restoring normal operation. To disable Mac
Mode, open the configuration file CONFIG.TXT (see section Configuration files) and add the
following entry:
MacMode=No
This option can also be configured with KL Tools (see section Using KL Tools)
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
17
National keyboard layouts
It is possible to enable a national layout for language-adapted keyboards, such as
French, German etc. This will allow national characters to get logged properly (including those
with Alt Gr), such as ö, æ, ß, ó etc. The following example demonstrates the advantages of
applying the German national layout.
Text logged without layout
Text logged with layout
Kezlogger )PS-2 / USB=
KeyLogger (PS/2 & USB)
To enable a national layout, the appropriate layout file named LAYOUT.USB (for USB
version) or LAYOUT.PS2 (for PS/2 version) must be placed on the flash disks root folder. The
file must be copied in Flash Drive mode. Layout files may be obtained from the CD-ROM
attached with the device.
USB version
PS/2 version
To enable the layout safely remove the flash disk. During the next power-up, the layout file
will be loaded automatically.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
18
Using KL Tools
KL Tools is a free application delivered with all KeyGrabber series devices. KL Tools assists
in configuring a KeyGrabber keylogger and retrieving the recorded data it contains. It is not
necessary to operate the device, but may speed up usage by its intuitive user interface.
KL Tools is available on the CD-ROM attached with the device. Installing KL Tools is
straightforward. Simply follow the installation wizard and answer standard questions. When
initialized, KL Tools will ask for the device type, and assist in configuring the device and
retrieving the log file. There is no special knowledge required to use KL Tools –simply follow
the instructions displayed by the application.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
19
Specifications
KeyGrabber TimeKeeper
USB
KeyGrabber TimeKeeper
PS/2
Power supply
4.5 V –5.5 V DC
4.5 V –5.5 V DC
Max. power consumption
65 mA (0.33 W)
65 mA (0.33 W)
Maximum burst log speed
(approx.)
500 byte/s
500 byte/s
Maximum continuous log
speed (approx.)
100 byte/s
100 byte/s
Memory capacity
2 GB
2 GB
Data retention
100 years
100 years
Keyboard support
USB HID-compatible
keyboard (Low-speed, Full-
speed, High-speed)
PS/2-compatible keyboard
Dimensions including
connectors
(L x W x H)
53 mm x 20 mm x 12 mm
(2.1" x 0.8" x 0.5")
48 mm x 15 mm x 15 mm
(1.9" x 0.6" x 0.6")
All KeyGrabber products come with 1 year warranty against manufacturer defects. Defect
products must be shipped by the customer. All warranty repairs and delivery to the customer
will be paid by the manufacturer.
KeyGrabber TimeKeeper
Copyright © 2013 KeeLog
20
Troubleshooting
The KeyGrabber TimeKeeper will not work with the following hardware configurations:
1. Internal laptop keyboards
2. Bluetooth keyboards
3. USB-PS/2 and PS/2-USB adapters
4. Non-conformant USB or PS/2 keyboards
The keyboard is not responding
The keyboard connector or the keylogger connector is not inserted firmly. Please check the
connection with the PS/2 or USB keyboard and port.
Problems with time-stamps
Set the correct time by creating a clock configuration file TIME.TXT. Make sure you have not
disabled time-stamping. Refer to the Clock configuration section for detailed instructions.
Problems with logging national characters
Please check if you have downloaded the correct layout file and copied it to the flash disk root
directory? If not, please check the National keyboard layouts section.
The keylogger does not switch to Flash Drive mode (USB version)
Please check the following:
1. Is the keylogger inserted between the keyboard and the keyboard port on the PC or
hub?
2. Is your 3-key combination correct?
3. Are you pressing the 3 keys simultaneously? The 3-key combination will not be
accepted if pressed sequentially.
The keyboard doesn’t work in Flash Drive mode (USB version)
This is normal behavior for non-MCP devices. In Flash Drive mode, the keylogger will install
the removable disk instead of the keyboard. Use the mouse to copy the log file to the hard
drive, then restore normal operation. Alternatively, you may connect the keyboard to a
different USB port after switching to Flash Drive mode.
Table of contents
