Brett's Ramblings

Font size: +
5 minutes reading time (965 words)

Personality of a computer

From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the Suspect Behind the Keyboard. I want to expand upon beyond the registry regarding a computer having a personality.

The bullet point

By examining multiple computers (or a single system) for computer usage and/or configuration, the owner of the computer can potentially be identified or tied to the computer.

The longer version

I am sure that each time you buy a new computer (laptop, smartphone, tablet, etc…), you spend the first minutes or hours setting it up just the way you like it. Whether it is changing the desktop background, colors, fonts, sounds, or general configuration, you make it yours. You do this every time. To every system that you have. You make it yours.

The way that anyone sets up their machine reflects their likes, dislikes, wants, needs, priorities, and general flow of system use. Generally, and most always, all the systems of one owner are set up very similarly. This is a simple observation; however, it can be a very important investigative clue when you have a system that has been disavowed by a suspect. Any computer that has been disavowed by a suspect (“That’s not my laptop!”) just might have relevant evidence on it if it does in fact belong to the suspect. But how do you prove it if there is nothing on the computer that directly names your suspect?

I have only come across this scenario once where the analysis of one anonymous machine seized in a public space, with a suspect disavowing ownership of the machine, needed to be proven against the other machines. Most other cases eventually have the owner admitting possession or ownership before the cases eventually gets close to trial. For the types of cases where the suspect never claims ownership of their computer(s), this post is for you to tie a computer that has no obvious relation to your suspect, but actually does belong to your suspect. I can tell you that it worked at least once for me; I suspect it can work for others too.

Basic and easy stuff

With multiple systems, find what is similar (not the default configurations) among all the systems.  Check for the same things that you configure your personal computers at home or work. Is the customized desktop background image the same across devices? Are the software applications the same? Sound settings? Computing naming conventions the same, such as naming all the systems based off a movie or sports team?  These are the easy and obvious things.

Given odds and statistics as they are, I cannot imagine the odds of two or more computer systems being customized for personal use exactly, or near the same way, across more than one device. Even a throwaway laptop that is being used by a suspect to reduce the risk of personal data being created on the laptop will have personal configurations that can be tied to another machine.

A little more work

The computer activity is another clue.


Which programs have been custom set to autostart? What is the Internet history? Bookmarks? Sequence of using programs? Does the user open the same programs on all machines?  Do the machines have the same programs, especially the same unique type of programs?

Network connections

Are network connections the same? Even as public WiFi is accessible by anyone, have the machines accessed the same public WiFi?


Length of use for the machines?  Are the times of use for the machines similar, such as being used at a certain time of day, or certain day of the week?  Is the user activity of the machines consistent with only one being used at a time, potentially indicating one user controlling the machines? Did multiple machines connect to the same WiFi on the day or within a short time frame?

Music and video

Whether downloaded or streamed, is there indication that the same music and videos have been played, or the same genre of music and videos?


Are search terms similar or the same? Identical bookmarks? Identical visited Websites? Same browsers? Same browser customizations?

The list goes on

The amount of unique user activity that you can find on a system is potentially limitless, as each person is different. Yes, it is possible for two different people to have something similar on their respective computers. However, the odds decrease with each similar (but unique or customized) aspect that you can match between systems are found.

This is what I call the Computer’s Personality. The user’s personality of likes and dislikes, preferences, biases, and desires eventually become obvious on all machines that they use on a regular basis. So when you have that one machine in a collection of machines that you need to identify the owner, take a look at the personality of all the machines and see if they match up to one owner. Sometimes it may be easy enough, other times you may have to really dig into the system, but either way, if you can match the computers to each other, all you need is to tie one of the computers to the suspect in order to tie all the computers to him.

Not to ignore non-personality clues, there are many other methods of tying a computer to a person when you have multiple systems. For example, geolocation forensics is a good method, where if you can show two or more systems traveling together for any amount of time, then probably the same owner is controlling those systems. Fingerprints too. The Computer Personality is just another tool to consider when you really want to tie someone to their device and eliminate all arguments to the truth.


Stay Informed

When you subscribe to the blog, we will send you an e-mail when there are new updates on the site so you wouldn't miss them.

Everything I Needed to Know about Working in DFIR,...
Add a Dab of Balance in your DFIR World