Section 10 Correlation Engine problem

[Ross_Wilkinson]

Hi there,

I have been working my way through the course and most functionality has worked normally, however I have ran into a problem with Section 10. When I run ingest modules on the SD card no interesting items are returned (which I presume I need to complete the questions).

I have tried running the scan several times on both the laptop and SD card - this has not worked. I have also tried deleting the central repository and starting a new case from scratch, firstly running ingest modules on the laptop and then the SD card - this also did not work.

Thanks,

Ross

[John_Lehr]

There are not many results for the SD card image, but I suspect what you are experiencing has more to do with your Global view settings. By default, the ingest results are merged.

If you want to see them separately, click the gear wheel at the top of the left pane, and check Group by Data Source. Now, each device will have its own Data Source Files, Views, Results, and Tags sections,

[Ross_Wilkinson]

Good evening John,

Thank you very much for taking the time to reply, it’s greatly appreciated.

I tried applying your suggestion with a new case file and new central repository database - the laptop and SD card and segregated into their own areas now (a handy tip regardless!), however, I did not return any 'Interesting Item’s as I expected to. Just in case I’m missing something else, I’ve also attached a screenshot of my Autopsy after doing so.

Cheers,

Ross

[John_Lehr]

Forgive me, but is the section on matching a hash set? If so, did you configure the hash set to mark matches as notable?

[Ross_Wilkinson]

Hi John,

This is how I have hash lookup set:

The hash I am using in that file is 07c94320f4e41291f855d450f68c8c5b which shows up as a hit on the laptop, but not on the SD card.

I’ve also tagged the photo of Renzik in the restaurant as notable on the laptop, but it Autopsy does not seem to be marking the same photo as interesting on the SD card.

Thanks again,

Ross

[John_Lehr]

You pictured the Ingest modules run, but not the configuration of your Ransom Case hash set. You can find that in Tools --> Options --> Hash Sets or by clicking the Global Settings button on the Ingest Modules configuration screen. Can you post a screen shot of that with your Ransom Case hash set selected?

[Ross_Wilkinson]

Hi John,

Apologies, I misunderstood.

Thanks,

Ross

[John_Lehr]

Hi Ross,

It looks to me that you are set up correctly and ran the correct ingest modules. I cannot tell if you ran the ingest modules against the correct device.

If you navigate to Views | File Types | By MIME Type | Image | jpeg (or any file view for that matter), to the files have hash values in the MD5 Hash column of the file listing?

[Ross_Wilkinson]

Good morning John,

I can see MD5 hashes on both devices - I’ve attached screenshots below of examples of both.

Thanks again,

Ross

[John_Lehr]

Though I have not seen a report for the Interesting Items results category, many users have reported results not appearing after ingest until Autopsy has restarted, in particular the USB Device Attach results section.

We haven’t discussed how you set up your Central Repository, but beyond creating one in SQLite and saving to a reachable location, there isn’t much more to do. I’m going to review mine and tell you how to check yours…

[John_Lehr]

It looks like Autopsy builds results on the fly, which probably explains why restarting refreshes the results for many users. The central_repository.db, while interesting, doesn’t explicitly store tables related to the results categories (which make sense, it’s just an information collection tool to be queried on a case by case basis).

None the less, here are the results of my case analysis related to the file in question:

You can see the the two data source ids corresponding to the two devices and the matching hashes. You can check yours with a sqlite viewer to ensure your repository captured the necessary information.

Otherwise, I’d check the logs in the case folder to see if you can determine where the failure occurred and make a bug report. Just be sure to list your steps carefully to allow the developers to reproduce the error, if possible,

[leeyc0]

I am unable to get an interesting item either, but I do get other occurrence results.

[fjaviercn]

Hi;

I have the same “problem” as Ross_Wilkinson.

I have created a new case from scratch, using only the mediacard.e01 data source and imported and created the hash sets indicated in lab 6. Same result, nothing marked as “notable” in “Interesing Items” … but … after review LAB6, point 8 say:

8. While reviewing the images in that folder, it is noticed that “IMG_20191024_155744.jpg” shows health violations by bringing the dog into a restaurant. We want to tag this as Notable:

   Right click on it
   Select “Add File Tag” and choose “Notable Item”

After doing it and run ingest modules again in “device2_mediacard.e01”, i get a one interesing file ( Previusly Tagged As Notable - Central Repository - )

Hope that helps,

Regards

[ABS22]

Hi Ross,

I had the same issue some days ago, and finally I´ve just got the answer. In the first data source there are 2 image files that are named equal. Maybe later i will understand why there are 2 different files with the same name (it could be due to the folder where the file was - Recycle bin), anyway, once I noticed this, I just tagged both files and re-run the correlation engine, and i got my new NOTABLE ITEM. I hope it helps you too.

Best regards,

ABS

Image 1: 2 files with the same name in the Data Source 1
Image 2: New Interesting File (2 Ocurrences)
(*) As a new user, I wasn´t able 2 upload 2 images,

[carrier]

@ABS22: I’m not seeing the 2nd version of the file (which looks like it has all 0s for its time stamps). If you select it and view the “File Metadata” tab on the bottom, can you post it here?

[ABS22]

sorry for the delay in responding

[The_Hacksmith]

But here in this case we know everything but in real cases How to resolve such errors

[hetzer1202]

I have the same problem. There are also yellow triangle signs beside the three ingest modules. It seems to be lacking the SQLite database. I have tried to reinstalled Autopsy and it doesn’t prompt me to configure the database engine in the installation. And I cannot find a way to configure it after the installation process. I am using 4.14.0 64 bit version on Windows 10.

[SK49]

Lab 6 had you tag an IMG file.
Lab 7 had you create interesting file rules. This caused Autopsy to populate its ‘Interesting Items’ tree for the first time.
Lab 10’s correlation module caused Autopsy to create a ‘Previously tagged as notable (Central Repository)’ within the’Iinteresting Items’ tree item, due to the media card also containing the IMG file that was tagged in Lab 6

[cory]

I believe I’ve discovered what the issue is. On lab 6, we were asked to add the md5 hash 07c94320f4e41291f855d450f68c8c5b to our hash set and configure it to mark any files that match that as notable. However, the quiz for lab 9 expects for the file with md5 hash d8753a49ebca177ae227c1566fb4ee9f to be marked as interesting.

If you do a “File Search by Attributes” for the md5 hash “d8753a49ebca177ae227c1566fb4ee9f”, then you can manually mark it as notable (and add it to your ransom hash set). From there, you can rerun the “Correlation Engine” ingest module for the second data set to have it correctly identify the interesting files.