Tags: forensics usb-keyboard
1. Take the mappings from the pdf documentation, and create a dictionary of hex -> key value pairs.
2. Write a script which loads the `pcap` file, using `scapy` for example.
3. Read the 6th and 8th bytes counting from the end of each packet data.
4. Use the 8th byte to detect `Shift` presses.
5. Use the 6th byte to determine the symbol being typed.
6. String it all together (we can also handle backspace by removing the last element from our string).