KEYPhantom USB Keylogger User manual

KEYPhantom™ USB
USB Keylogger
Users Guide
KEYPhantom™USB Users Guide
Page 1
This page is intentionally left blank.

KEYPhantom™USB Users Guide
Page
2
Website
For Frequently Asked Questions, Troubleshooting, or more
general information, feel free to visit us at:
http://www.keyphantom.com/
Warranty Claims
Please do not return devices to the place of purchase. In the
event that a device is defective, please browse to:
http://www.keyphantom.com/warranty/
Instructions are provided for repair/replacement of a defective
device. All warranty claims must be submitted in the original
anti-static bag with identification sticker in place. Warranty
claims which are due to a forgotten password will be charged a
$40 fee for resetting the device to its factory default password.
Please note that as the contents of the flash is encrypted,
resetting the password will erase the contents of the log.
Terms of Use
All users must agree to the terms described in the “Use
Agreement” (located at the end of this guide) before using this
device. If you do not agree to the terms described, DO NOT USE
THE DEVICE.
Trademarks
Wordpad® is a trademark of Microsoft Corporation.
Microsoft Windows® is a registered trademark of Microsoft
Corporation.
KEYPhantom™ is a trademark of DesignREM Limited.
KEYPhantom™USB Users Guide
Page 3
1. Overview
The KEYPhantom USB device records USB keystrokes from any PC
or Macintosh computer, from the moment the computer is
powered on.
It is compatible with any operating system running on a PC or
Macintosh, including Windows® 95, 98, 98SE, 2000, XP, Vista,
Linux, BeOS, DOS, or OS/2, or Mac OS.
This guide covers the following devices available from
www.keyphantom.com:
•KEYPhantom USB Home (256K). Product code: “KP-USB-301”.
•KEYPhantom USB Corporate (1024K). Product code: “KP-USB-302”.
•KEYPhantom USB Corporate SE (1568K). Product code: “KP-USB-303”.
•KEYPhantom USB Forensic (2048K). Product code: “KP-USB-305”.
For a comparison between these products, see:
http://www.keyphantom.com/comparison/.
2. Installation
Installation of the KEYPhantom™is very simple – the
KEYPhantom™ USB is inserted between the USB keyboard and the
PC.
1) Unplug the USB keyboard cable from the back of the
computer.
2) Plug the USB keyboard into the KEYPhantom™ cable.
3) Plug the KEYPhantom™ USB cable into the back of the
computer, with the keyboard cable still attached. See figure
1 below.

KEYPhantom™USB Users Guide
Page
4
Figure 1 – Installation Diagram
3. Retrieving Log
The log of keystrokes can be retrieved from the KEYPhantom™
using either the “Text Editor” or “Windows®Utility” method, as
shown in table 1:
Log
Download
Method:
Log Download –
Windows® Utility Log Download - Text Editor
Method of
downloading
log:
Download log using a
Windows® utility – the
“KEYPhantom™ USB
Windows Toolkit”.
Download log using a
standard text editor.
Operating
system: Windows® 2000/XP/Vista. Windows® (all versions), Linux (all
version), DOS, BeOS,
OS/2, Mac OS (all
versions).
Advantages: Recommended for
Windows® users; log is
downloaded very
quickly, log can be
filtered, keyboard
layouts can be changed,
log is more
comprehensive.
Recommended for
Linux or Macintosh
users; works in any
text editor.
Instructions: See chapter 4. See chapter 5.
Table 1: Methods for retrieving log of keystrokes from the
KEYPhantom™ USB.
KEYPhantom™USB Users Guide
Page 5
4. Retrieving log using a Windows® utility
The log of keystrokes can be downloaded using a Windows®
utility, namely the “KEYPhantom™ USB Rapid Downloader”. See
the screenshot in figure 2, below.
The “KEYPhantom™ USB Rapid Downloader” is available from:
http://www.keyphantom.com/rapiddownload/
The “KEYPhantom™ USB Rapid Downloader” is compatible with
Windows® 2000/XP/Vista. This utility is highly recommended –
the log downloads very quickly compared to the traditional
method of scrolling keystrokes into an editor; there are more
features such as log filtering and firmware upgrading.
Figure 2 - KEYPhantom™ USB Rapid Downloader utility

KEYPhantom™USB Users Guide
Page
6
5. Retrieving the log using a text editor
Open any word processor, or any text editing program. It is
recommended that you use Microsoft Wordpad. Wordpad comes
with all versions of Windows®. Wordpad can be launched by
selecting: “Start … Run” then typing “Wordpad” into the text
entry box. Wordpad is also available by selecting “Start …
Programs … Accessories … Wordpad”.
1) Type phxlog into Wordpad. This is the default password that
is set at the factory. If you make an error typing in the
password sequence, start typing the password from the
beginning again. Do not press any keys after the password.
Do not press the enter key after the password.
2) You should now see the menu appear on the screen (see
Figure 3 on the next page).
3) In order to view the contents of the memory, press the “1”
key. At this point, the memory contents will be displayed on
the screen.
4) After you have finished viewing the contents of the memory,
you may wish to erase the contents of the memory. This is
done by pressing the “3” key. The menu will be re-displayed
when the memory has been fully erased.
5) After you have erased the contents of the memory, press any
key to exit the menu. The KEYPhantom™ will display “Record
mode.” on the screen to indicate that you have exited the
menu. Any key other than the numbers 0 to 9 will also exit
the menu.
You have now learned most of the things that you will need to
know in order to use the KEYPhantom™. Read on to learn about
the other options.
KEYPhantom™USB Users Guide
Page 7
Figure 3 - KEYPhantomTM USB menu
The following menu options are available from the KEYPhantom
USB device:
1. Full Memory Download
When you select the ‘Full Memory Download’ option, the
KEYPhantom™ will begin sending the memory contents to the
screen. When the entire memory has been displayed, the menu
will be sent to the screen. Pressing any key will abort the
download process.
2. Partial Memory Download

KEYPhantom™USB Users Guide
Page
8
When you select the ‘Partial Memory Download’ option, the
KEYPhantom™ will first ask which point in the log to begin
sending from. It will then begin sending the memory contents to
the screen.
3. Erase Memory (quick)
When you select the ‘Erase Memory (quick)’ option, the
KEYPhantom™ will perform a quick erase of the log contents.
Note that unlike the menu option “Erase Memory (thorough)”, it
would still be possible in theory to recover the contents of the
memory with a flash chip reader.
4. Erase Memory (thorough)
When you select the “Erase Memory (thorough)” option, each
sector in the flash is overwritten multiple times. This option is
useful if it becomes absolutely necessary to delete the contents
of the log, with no possibility of retrieval.
5. Modify Password
The default password set at the factory is phxlog. It is highly
recommended that the password be changed from the default
setting. There are a couple of points about the password that are
very important.
Review and understand this section before you change the
password.
1) Select a unique password.
2) Do not use a password or subset of a password that you
are using elsewhere on your system.
3) The password should not be a string of characters that
would be typed in normal usage. Examples of poor
password choices would include: father, avenue, your
pet’s name. Here are some good password choices:
tabthett, ddfrhome, and ddghurdd. A password should be
KEYPhantom™USB Users Guide
Page 9
a consecutive set of characters that would never be
typed, except by someone who knew the password.
4) The password must consist of the letters A-Z.
5) Passwords are not case sensitive.
6) The KEYPhantom will prompt you to enter the password,
and then re-enter the password.
7) If the password is forgotten or lost, the device must be
returned to the factory for a reformat. It is
recommended that the password be written down in the
event that it is forgotten.
8) The password has a maximum length of 17 characters.
9) The number of combinations for the password is 2617 or
1,133,827,315,385,150,725,554,176. It is virtually
impossible that anyone else could guess your password.
6. Diagnostics
Displays diagnostics information about the device, including the
percentage of the device used, encryption status, date/time (for
Forensic units) and more.
7. Firmware Upgrade Mode
Used to upgrade the firmware in the device, to add additional
features such as encryption of the data inside the device, and a
larger memory size.
To download the KEYPhantomTM Windows Toolkit utility used to
upgrade the firmware inside the device, browse to:
http://www.keyphantom.com/firmware/.
See chapter 6 for more information.

KEYPhantom™USB Users Guide
Page
10
8. Options - Language
The language that the menu is displayed can be changed.
If you wish to support for additional languages to the device,
such as French, German, Japanese or Arabic, email
[email protected].
8. Options – Date/Time
This section is applicable to the KEYPhantom™ USB Forensic
model (KP-USB-305) only.
Use this menu to alter the date and time for the time stamping
of the log.
The date/time stamps in the log are inserted every 60 seconds.
The date/time in the unit is automatically set whenever a
firmware upgrade takes place, and can be set using the
“KEYPhantom™ USB Rapid Downloader” – see chapter 4.
9. Speed
Certain older computers will not work properly if the menu is
generated at extremely high speed. If the menu exhibits the
occasional incorrect character, use the “Speed” menu option to
slow the menu operation down.
Most modern computers will easily handle menu generation at
the fastest speed.
If you are using a Macintosh the fastest menu speed you can use
is setting 5.
0. Quit
When you are finished with all KEYPhantom™activities, be sure to
choose the ‘Quit’ option from the menu.
KEYPhantom™USB Users Guide
Page 11
6. Firmware Upgrade
The KEYPhantom™ USB is completely firmware upgradeable. See
figure 4 below.
See http://www.keyphantom.com/firmware/ for instructions,
and the Windows® utility to perform the firmware upgrade.
If you experience any compatibility problems with your
KEYPhantom™, email [email protected]. Most problems
can be resolved within 1-5 business days.
Figure 4 - KEYPhantomTM USB Firmware Upgrade Utility

KEYPhantom™USB Users Guide
Page
12
USER AGREEMENT
This Agreement is between DesignREM, Inc. ("DesignREM") and you, the
user or installer of the KEYPhantom keystroke recording device (the
"Device"). Your installation or use of the Device indicates your consent to all
of the terms of this Agreement. If you do not agree to any term of this
Agreement, do not install the Device. Return the bag unopened to the place
of purchase for full refund.
PERMISSIBLE USES
The Device was designed and is to be used solely for parents to monitor what
their children are doing on the computer and for businesses to monitor what
their employees are doing on the computer (the "Permissible Uses").
IMPERMISSIBLE USES
The Device may not be used to violate the privacy rights of others, or to
access or intercept electronic communications in violation of wiretap
statutes, or to violate company regulations ("Impermissible Uses").
Impermissible Uses include, but are not limited to the following acts:
retrieval of credit card information, passwords, personal and/or medical
information, confidential and/or proprietary information, or trade secrets.
Privacy and wiretapping laws change from time to time and vary from state
to state. It is your responsibility to ensure that you are in compliance with
federal, state, and local laws.
MUST POST NOTICE of MONITORING
If anyone other than you will be using the computer on which the Device is
installed, you agree to post a notice visible to each user of the computer to
the effect that (i) activities on this system may be monitored and recorded
and (ii) that anyone using this system expressly consents to such monitoring
and is advised that if such monitoring reveals possible evidence of
unauthorized or criminal activity, such evidence may be provided to
company or law enforcement officials.
SERIAL NUMBER FOR INVESTIGATING ILLEGAL
ACTS
KEYPhantom™USB Users Guide
Page 13
A unique serial number may be electronically stored in the Device to aid
company and law enforcement officials in the investigation of any
unauthorized or illegal acts that may be committed with the Device. You
agree to permit DesignREM to assist these officials by providing serial
number and sales information as necessary in the course of the
investigation. DesignREM may request the assistance of its distributors
and customers in providing information relating to the serial numbers of
such Device(s), and you agree to cooperate with such requests.
LICENSE
The Device contains software and firmware instructions (the "Program")
on the internal microcontroller. The Device and Program are protected by
copyright and other intellectual property laws.
DesignREM hereby grants you the right to:
a) use the Program for the Permissible Uses in the United States for as
long as you own the Device.
b) view, copy, print and distribute copies of the information provided by
the Device provided
(1) the information is used for informational purposes only; and
(2) any copy of the information (or portion thereof) includes the
following copyright notice: (c)2000-2006, DesignREM, Inc. All Rights
Reserved.
This license is limited to the rights above. Therefore, you are expressly
prohibited from taking any other action with the Device, including but
not limited to:
a) modify, reverse engineer, de-compile or disassemble the Device or the
Program;
b) make any attempts to defeat the code protection which is in place on
the internal microcontroller;
c) make any attempts to read or copy the Program;
d) attempt to open the casing around the Device;

KEYPhantom™USB Users Guide
Page
14
e) rent, lease, lend, or sublicense the Device to others;
f) transfer your rights to another, unless the recipient agrees to the terms
of the Agreement.
LIMITED WARRANTY
DesignREM warrants that the Device, if provided by DesignREM, is free
from defects in material and workmanship and for ninety (30) days from
the date of original purchase of the Device, provided the Device was not
subject to accident, abuse, or improper use.
THIS IS A LIMITED WARRANTY AND ALL OTHER
WARRANTIES ARE EXPRESSLY DISCLAIMED, INCLUDING BUT
NOT LIMITED TO WARRANTIES OF TITLE, NON-
INFRINGEMENT OR IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. DesignREM'S SOLE LIABILITY FOR ANY BREACH OF
THIS WARRANTY SHALL BE, IN DesignREM'S SOLE
DISCRETION: (i) TO REPAIR OR REPLACE YOUR DEVICE.
DesignREM will honor this warranty only if you inform DesignREM of
your problem with the Device during the applicable warranty period and
promptly provide evidence of the date the Device was originally
purchased. This warranty is void if you violate the terms of this
Agreement.
To invoke the warranty, complete the warranty form found in the back of
the Operating Guide or at www.keyphantom.com. Send the completed
warranty form, the defective device, and a copy of the purchase receipt or
other evidence of the purchase date to: Allen Concepts Inc., 1900 W.
Chandler Blvd., Suite 15-264, Chandler, AZ 85224. Include your name,
address, and telephone number. Allen Concepts Inc., on behalf of
DesignREM, will repair or replace the device and return it to you. If the
device is working properly and the password stored inside the Device
does not match the password provided on the Warranty Form, you will be
charged $40 for resetting the password. The Device will be returned to
you along with the new password, and an empty log.
FORGOTTEN PASSWORD
KEYPhantom™USB Users Guide
Page 15
If you have forgotten your password, send the Device to: ACI, 1900 W.
Chandler Blvd., Suite 15-264, Chandler, AZ 85224. Include your name,
address, and telephone number. ACI will reset your password and charge
you $10 for this service. The Device will be returned to you along with
the new password. Users should be aware that resetting the password
also clears the log.
INDEMNIFICATION
You agree to defend, indemnify, save and hold DesignREM harmless
from any and all claims, demands, liabilities, costs or expenses including
direct, indirect, incidental or consequential damages and reasonable
attorney’s fees resulting from the Device, including loss of business or
profit.
LIMITATION OF LIABILITY
UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL
THEORY, WHETHER TORT, CONTRACT, OR OTHERWISE,
SHALL DesignREM OR ITS SUPPLIERS OR RESELLERS BE
LIABLE TO YOU OR ANY OTHER PERSON FOR ANY INDIRECT,
SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF
ANY CHARACTER INCLUDING, WITHOUT LIMITATION,
DAMAGES FOR VIOLATION OF THE RIGHT TO PRIVACY,
VIOLATION OF WIRETAPPING STATUTES, LOSS OF
GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR
MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL
DAMAGES OR LOSSES. IN NO EVENT WILL DesignREM BE
LIABLE FOR ANY DAMAGES IN EXCESS OF THE PURCHASE
PRICE, EVEN IF DesignREM SHALL HAVE BEEN INFORMED OF
THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY
ANY THIRD PARTY.
EXPORT CONTROLS
You may not export or re-export the Device or the Program (i) into (or to
a national or resident of) Cuba, Iraq, Libya, Sudan, North Korea, Iran,
Syria or any other country to which the U.S. has embargoed goods; or (ii)

KEYPhantom™USB Users Guide
Page
16
to anyone on the U.S. Treasury Department's list of Specially Designated
Nationals or the U.S. Commerce Department's Table of Denial Orders.
GOVERNING LAW
This Agreement shall be governed in all respects by the laws of New
Zealand, except for conflict of laws provisions. The parties agree that for
any dispute, controversy or claim arising out of or in connection with this
Agreement, venue and personal jurisdiction shall be in a court with
competent jurisdiction located in New Zealand.
SEVERABILITY
The provisions of this Agreement will be deemed severable, and the
invalidity or unenforceability of any provision will not affect the validity
or enforceability of another provision hereof.
ENTIRE AGREEMENT
This Agreement constitutes the entire agreement and understanding
between the parties and may be amended only by a writing executed by
both parties.
All Materials are the property of DesignREM, Ltd. Copyright 2004 -
2006 DesignREM, Ltd. All Rights Reserved.