In Meterpreter keystroke logging, what does keyscan_start do?

• A. It starts a keylogger by migrating into a visible process and polling for keystrokes entered into the system every 30 milliseconds.
• B. It exports the keystroke buffer to a file on disk.
• C. It clears the keystroke buffer without collecting new keystrokes.
• D. It enables keystroke collection by polling at 30 ms and buffering keystrokes in memory.

Answer: (D)

Keyscan_start enables keystroke collection by turning on the keylogger and starting a polling loop that checks for keystrokes about every 30 milliseconds, buffering them in memory. This in-memory buffer can later be retrieved with a separate dump command. It does not export to disk by itself, nor does it clear the buffer or require migrating into a visible process. The essential idea is that keystrokes are captured through a periodic poll and stored in memory for later retrieval.