Nonclassical Forensics - You Are What You Type



User avatar


Posts: 4270

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Thu Aug 24, 2006 10:15 am

Nonclassical Forensics - You Are What You Type

Here is an interesting topic championed by Dr. Neal Krawetz. In a nutshell, classical forensics deals with specific evidence tied to a specific person or event. Nonclassical forensics deals with the art (and science) of putting together small, mundane details that reveal more than just the content of the evidence.


1. Certain words used can give probabilites of whether the author is male or female or what their native tongue is.
2. Coding practices can help determine who wrote a portion of a malicious program.

Dr. Krawetz presented at Black Hat. In his own words:

You are What You Type: No Classical Computer Forensics
by Dr. Neal Krawetz

My talk, "You Are What You Type", covers some of my research on anti-anonymity technologies.  I'll show you techniques for telling if two documents are likely written by the same person, how to better guess gender and nationality, and even how to determine physical attributes like left/right handed, if someone is sitting too close to the monitor, and where their mouse is located.  I'm including many real examples that cover the gambit from spammers and phishers to computer viruses and online dating.

Find his web site here:

Get the presentation from Black Hat:
http://www.blackhat.com/presentations/b ... rawetz.pdf

Read an interview with Dr. Krawetz:
http://www.infoworld.com/article/06/08/ ... ain_1.html




Posts: 1

Joined: Thu Aug 24, 2006 11:24 am

Post Thu Aug 24, 2006 11:43 am

Re: Nonclassical Forensics - You Are What You Type

Pretty interesting!

I just took a look at the powerpoints and wanted to add that they actually refer to a free online gender guesser at www.hackerfactor.com.&nbsp; I tried it out.  The results were not conclusive (it said my informal writing was weak male and my formal writing was weak female), but it deduced that my writing influences were European, which could be true.


Post Fri Aug 25, 2006 5:42 am

Re: Nonclassical Forensics - You Are What You Type

I'm not sure I like being classified, "Weak MALE." It's interesting stuff, bringing the ideas of personal/psycological profiling into forensics.

It is possible to speculate on where a coder is from based on certain programming memes, but doesn't the Internet remove a lot of the geographic isolation needed for real 'dialects' to grow and be sustained?


Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software