There are intrusive ways (that is, the operator knows this copying is being done) to do this with standard commands such as STRCPYSCN. You are able to see keystrokes that modified the display when a function key was used that returns modified data, but not what function key might have been used. You may want to look at the help text for STRCPYSCN and give it a few tests.
As a software provider, I also have a non-intrusive (the user doesn’t know) utility that can capture every screen going out, every keystroke that modified the display when a function key was used that returns modified data, and what function key (F3, F12, Enter, Page Down, etc) was used. This utility can be customized to your specific needs.
Neither approach will detect keystrokes such as entering an “a”, and then backspacing and replacing the “a” with a “b”. You would only see the “b”.
Bruce Vining Services