The adversary may want to correlate user identities or sessions across multiple remote services.
For instance, advertising networks may wish to know that a user who visited `site-x.com` is the same user that visited `site-y.com` to serve them targeted ads while law-enforcement may wish to associate anonymous activity on `site-b.com` with a known identity on `size-a.com` to build a criminal case.
5.**Fingerprinting/anonymity set reduction**
Fingerprinting (more generally: "anonymity set reduction") is used to attempt to gather identifying information on a particular individual without the use of tracking identifiers.
If the dissident's or whistleblower's timezone is available, and they are using a rare build of Firefox for an obscure operating system, and they have a specific display resolution only used on one type of laptop, this can be very useful information for tracking them down, or at least tracking their activities .
6.**History records and other on-disk information**
In some cases, the adversary may opt for a heavy-handed approach, such as seizing the computers of all Tor users in an area (especially after narrowing the field by the above two pieces of information).
