How can an attacker track someone using Whonix like tor-gateway?
From the tor homepage:
"Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit." https://www.torproject.org/about/overview
Also, tor & other tools, such as a browser used while on the tor network, can have vulnerabilities which can de-anonymize you. These have been actively exploited by government agencies. Recent example: http://arstechnica.co.uk/security/2016/12/tor-releases-urgent-update-for-firefox-0day-thats-under-active-attack/
Traffic correlation attack should be relatively easy to avoid if you don't post, and just browse multiple different websites simultaneously.
However there are other means, based on user activity. Generally if you generate any content - such as post something - and not just consume the content, using Tor/Whoenix alone is not enough.
A few things to consider:
The language use. For example, in a well-published case an administrator of darknet website, who used Tor, was tracked down and eventually arrested because he used unusual greeting. A search for this greeting provided few results, and following up on those was easy enough. Note that this kind of attack doesn't require significant resources or state powers.
People have been deanonymized by posting photos with geo-tagging enabled, reusing their identities (such as creating unusual user accounts), sharing extra information about themselves in private with "trusted" people, and so on.
Generally if you post anything at all, it makes it much easier to track you down. The more content you post, and the more unique it is, the easier you make it to track you down.
A browser exploit could be triggered against the "Workstation", and reveal all browsing sessions, which could be then correlated. For example, if the user is browsing the monitored site while logged into their gmail in another tab, such exploit might reveal both browser tabs. Generally, if a screenshot taken during any moment of your Tor session would reveal your identity, you're vulnerable.
But of course there are many other attacks. Even a simple timing attack - if a user A connects to Tor network at certain time each day, and a certain web site gets updated at the same certain time, one can correlate those activities even without monitoring the exit node traffic.