# Section 10 Correlation Engine problem **URL:** \ **Category:** Autopsy Online Training\ **Created:** [April 14, 2020, 7:11am UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793 "2020-04-14T07:11:51Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![blackbeard](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/blackbeard/32/653_2.png) [@blackbeard](https://sleuthkit.discourse.group/u/blackbeard)\ **Post date:** [May 1, 2020, 7:09pm UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/21 "2020-05-01T19:09:23Z")
> [@fjaviercn](#): > > While reviewing the images in that folder, it is noticed that “IMG\_20191024\_155744.jpg” shows health violations by bringing the dog into a restaurant. We want to tag this as Notable: > > Right click on it > Select “Add File Tag” and choose “Notable Item” As for today (May 1st), the item 8 is not in the lab 6, so I was not aware that I needed to tag the file as notable. So I fail on the first question on Section 10, since nothing was tagged previously. In this case, I located the file by myself, But I think the Lab on Section 6 was modified to remove this step of tagging the file. @carrier can you confirm that? ---
**Author:** ![BrianMoran](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/brianmoran/32/453_2.png) [@BrianMoran](https://sleuthkit.discourse.group/u/BrianMoran)\ **Post date:** [May 1, 2020, 8:00pm UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/22 "2020-05-01T20:00:09Z")
Hello, Thank you for your interest in Autopsy Training. As you can see from the attached screenshot, it t is indeed in the published version of the course, perhaps you inadvertently missed it while walking through the steps? Thank you ![Screenshot 2020-05-01 at 15.58.03](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/eec9f8a1481ff3d7ccc120d1c05e719785fc3755.png) ---
**Author:** ![Tony\_d22](https://avatars.discourse-cdn.com/v4/letter/t/f17d59/32.png) [@Tony\_d22](https://sleuthkit.discourse.group/u/Tony_d22)\ **Post date:** [May 2, 2020, 10:52pm UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/23 "2020-05-02T22:52:46Z")
I’ve had the same problem as Ross and others in that after adding the data source and running the ingest, nothing new is added to the interesting files. I’m wondering if the rule set for interesting files needs to be updated and then running the related ingest rule should be done to achieve the desired result. ---
**Author:** ![nielsD](https://avatars.discourse-cdn.com/v4/letter/n/bcef8e/32.png) [@nielsD](https://sleuthkit.discourse.group/u/nielsD)\ **Post date:** [May 3, 2020, 9:06am UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/24 "2020-05-03T09:06:36Z")
Same problem I have marked the file (DS: laptop.e1) as notable, and I _can_ find the files in question on the mediacard. . However I don’t see any correlation notice, and the new files is not flagged. My problem is that every now and then (not consistently) I’m getting a pop-up which explains that there is no commection to CR, so the module cannot run. I have restarted Autopsy a few times, but it makes no difference. ---
**Author:** ![BrianMoran](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/brianmoran/32/453_2.png) [@BrianMoran](https://sleuthkit.discourse.group/u/BrianMoran)\ **Post date:** [May 3, 2020, 1:57pm UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/25 "2020-05-03T13:57:57Z")
That sounds very much like something on your endpoint is either blocking the CR database and/or creation, or somehow your CR got corrupted. You may have to completely uninstall Autopsy, including removing the folders under your user profile, and reinstall it again. Or, if you are familiar with where Autopsy stores data, you could try just deleting, and then re-initializing , the CR related data, again. ---
**Author:** ![TheSwedishLord](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/theswedishlord/32/897_2.png) [@TheSwedishLord](https://sleuthkit.discourse.group/u/TheSwedishLord)\ **Post date:** [May 14, 2020, 5:02pm UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/26 "2020-05-14T17:02:55Z")
I got this issue too, I continued on another computer and forgot to do step 8 in Section 6 😉 ---
**Author:** ![CCAuto\_P](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/ccauto_p/32/91_2.png) [@CCAuto\_P](https://sleuthkit.discourse.group/u/CCAuto_P)\ **Post date:** [May 19, 2020, 1:02pm UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/27 "2020-05-19T13:02:47Z")
This is very accurate, but you must also add the hash set of the Rensik in the restaurant to the hash set\> Ransom Case or Create a new Hashset for the hash associated with that file. You only have to do this for that IMG\_20191024\_155744.jpg file if you don’t actually have the central repository (CR) setup properly. The reason being is that the correlation engine doesn’t parse data based on hash values. As seen in Quiz question True or False: The correlation engine module extracts and calculates data, such as hash values. So if the CR is setup the file marked as notable will always get correlated and notify you of a unique hit in the mailbox. If you don’t have the CR working than you had to right click and add that hash signature to the hash list and it will populate a unique hit because its stored locally as a unique variable that can be parsed through ingest modules. ---
**Author:** ![ballzop](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@ballzop](https://sleuthkit.discourse.group/u/ballzop)\ **Post date:** [June 29, 2021, 12:14pm UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/28 "2021-06-29T12:14:42Z")
I have tried to reinstalled Autopsy and it doesn’t prompt me to configure the database engine in the installation. ---
**Author:** ![ballzop](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@ballzop](https://sleuthkit.discourse.group/u/ballzop)\ **Post date:** [July 3, 2021, 5:52am UTC](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793/29 "2021-07-03T05:52:07Z")
> [@ballzop](#): > > I have tried to reinstalled Autopsy and it doesn’t prompt me to configure the database engine in the installation.[.](https://tomzpot.com/) [.](https://mdro.fun/mobdro/) can someone update on the issue ? [Previous page](https://sleuthkit.discourse.group/t/section-10-correlation-engine-problem/793.md?page=1)