Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the…

The correct answer is B. The logic, formatting and elegance of the code used in the attack. When profiling a hacker, the code they write serves as a behavioral fingerprint. The logic structure, coding style, comments, variable naming conventions, use of specific tools or libraries, and overall elegance (or lack thereof) can reveal the attacker's skill level, cultural…

Submitted by cyberguy42· Apr 18, 2026Malware Forensics

Question

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

Options

AThe manufacturer of the system compromised
BThe logic, formatting and elegance of the code used in the attack
CThe nature of the attack
DThe vulnerability exploited in the incident

How the community answered

(52 responses)

A
31% (16)
B
46% (24)
C
15% (8)
D
8% (4)

Explanation

When profiling a hacker, the code they write serves as a behavioral fingerprint. The logic structure, coding style, comments, variable naming conventions, use of specific tools or libraries, and overall elegance (or lack thereof) can reveal the attacker's skill level, cultural background, preferred techniques, and potentially link them to previous incidents. This is analogous to linguistic profiling. The hardware manufacturer is irrelevant to identifying the attacker. The nature of the attack and vulnerability exploited are useful contextually but do not uniquely fingerprint the individual the way code style does.

Topics

#Forensic profiling#Attacker attribution#Code analysis#Malicious code characteristics

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice