0

How to get the list of keys pressed in say an hour in the past. I have a Debian 9 Stretch.

Not sure. I googled a bit. All results are about programming. I don't think that is needed. There was be some log which can give me what I want. Just that I don't seem to know where to look for, nor how to look for it. Also google gives results that detects key pressed in the future, but not a list of keys pressed in the past.

I am okay to install anything that can keep running in the background.

This is for my security diagnostics (monitor online activity)

1 Answers1

2

The OS doesn't record info like this (why would it?) itself. Consider: if the OS itself logged keystrokes, there'd be little use for keyloggers as a kind of malware, yet in reality they're very popular. Unless you've been running a keylogger program, you probably can't get the data.

It may be possible to read the last few keystrokes out of the keyboard buffer if the memory wasn't zeroed or overwritten - though you'd probably need a kernel module to do it, since I doubt there's a way to get the raw memory of the kernel buffer from userspace by default - but the keyboard buffer isn't that big and isn't timestamped, so all you'd get at best are the last N keystrokes, whenever they happened. The keyboard buffer will also probably not survive a reboot, and a sufficiently-paranoid kernel dev may actually have set it up to zero itself out (especially after stuff like logging in a user) specifically to avoid it being used as a keylogger (I believe TrueCrypt does this for encrypted boot volumes; I know BitLocker on Windows does).

Otherwise, your "best" bet (in scare quotes, because what I'm about to suggest is not normally considered a good idea) is to install a keylogger on your own machine, set it up to log somewhere hopefully very secure (remember, it's going to catch all kinds of stuff, like passwords and email bodies and so on), and use that going forward. The data from before you install it is likely unrecoverable, but at least you'll have a growing file of everything you've ever typed in going forward...

CBHacking
  • 6,404