Interpretation of raw data
Always keep this rule in mind: "A keyboard is blind. It might record data and see keystrokes, but as long as no text field is selected it won't apear on the screen. Neither will it know what has been selected with the mouse."
Another thing to keep in mind is that alot of systems contain text finishing functions. So when subject is browsing you will see weird logging since a subject switches from tabs and only enters few random looking keystrokes. In general you will see this behavior apart from when large sizes of text are entered or passwords.
Special Keys
Stand Alone Keys
This paragraph will include examples of how special keys work and look like.
CAPS LOCK
<~C>What is intresting with Capslock, is how it works. It is not a key which is "Held Down" digitally when pressed. It is actually a toggle switch that gets send to the computer. So the keyboard doesn't decide what the state is of Capslock but the computer does. That's why we don't let the keys be changed to capital versions, this has to be interpreted by the data analyst, in which state it was at that moment and or time.
SHIFT
<~S>When shift is pressed, it will display the above key. When held down all coresponding characters will turn in to their capital version. Same will happen to symbols. So no interpretation is needed.
BACKSPACE
<~B>Backspace is self explanatory when pressed it will print the above key. When held down it only prints once since the computer/application decised what to do when a key is held down. Important to keep in mind is that data can be removed from a text field with out using backspace. This is possible because subject can select typed text and start typing again removing previous text.
TAB
Prints above key when pressed.
RETURN/ENTER
Prints above key when pressed. Thing to keep in mind is that all returns on keyboard will print this key.
ESC(ESCAPE)
Prints above key when pressed.
F-Keys
Prints above key when pressed.
INSERT
Prints above key when pressed.
HOME
Prints above key when pressed.
PAGE KEYS
Prints above key when pressed.
DELETE
Prints above key when pressed.
END
Prints above key when pressed.
ARROW KEYS
Prints above key when pressed.
CTRL
Prints above key when pressed.
ALT
Prints above key when pressed.
WINDOWS KEY
Prints above key when pressed.
Print Screen
Prints above key when pressed. This key is often hijacked by an application for a custom print screen version.
Scroll Lock
Prints above key when pressed. Same thing here accounts for capslock in which it is a toggle key and the state of the toggle gets decided by the computer.
Pause
Prints above key when pressed.
Function keys
At this point in time, Function Keys do not get logged and won't work. This has to do with that these are driver based. Since this product works like a active logging device and does't carry any drivers it is not able to interpret these functions. Because of this active logging we are able to turn of the keyboard when needed, inject keystrokes and or do extraction (this function is not yet utilised).
Special key combinations
When interpeting data it is very important that, when you look at key combinations, that you keep the following rules in mind.
First off combinations are not always clear, since a keystroke gets logged when pressed. For instance if we talk about a copy past example it can do the same but look different. This has to with if the subject holds down the key.
Another thing to keep in mind is when a person is using/holding shift the shift only gets printed when shift gets pressed but all the keys during the hold down will be printed in a capital form.
Normal characters
For normal Characters it is quite easy to interpret what has happend. There are couple things you do need to keep in mind. First of is that when a keystroke is held down it only registers 1 single entry, since the computer/device decides what to do with that action. For instance an Apple computer will only register 1 key stroke. But Windows devices, unless specified otherwise, will re-sumbit this character untill the key has been released.
Letters that have been logged in capital form, come from the key being pressed incombination with shift. The same accounts for symbols like those under your number keys.
Last updated