Keystrokes input by a user are stored in non-volatile memory together with time stamps, creating a record of keystrokes and associated time stamps. At least some of the time stamps are generated and recorded in response to receipt of specific keystroke events, such as a specific keystroke, a specific sequence of keystrokes, a keystroke following an interval of inactivity or an interval of inactivity following a keystroke. The resulting keystroke record may show sessions of keystrokes received, with a start and end time stamp for each session. An alteration record is also provided to track alterations and erasures of the keystroke record.