In this paper we investigate the potential of leveraging keystroke analysis - primarily used in user authentication - to user profiling and identification for forensic investigations. As such, the keystroke forensics approach proposed in this paper will support user profiling through integration with the offender profiling domain. Early findings show that it was possible to identify with significant probability the conditions and means a user is performing typing operations.