/*! \page central_repo_page Central Repository \section cr_overview Overview The central repository allows a user to find matching artifacts both across cases and across data sources in the same case. It is a combination of an ingest module that extracts, stores, and compares properties against lists of notable properties, a database that stores these properties, and an additional panel in Autopsy to display other instances of each property. The central repository database can either be SQLite or PostgreSQL. The following are some use cases for the central repository: - Finding Other Instances of a Property - If you navigate to a file or Autopsy artifact (such as a Web History item), there is a content viewer in the bottom right that will show you other instances of this property across the data stored in the central repository. - Alerting When Previously Notable Properties Occur - You can use the central repository to record which properties were associated with files and artifacts that were evidence (or notable). Once these properties have been tagged as notable they will be added to the Interesting Items section of the tree when seen again in any future cases. - Storing Hash Sets - You can create and import hash sets into the central repository instead of using local copies in the \ref hash_db_page "Hash Lookup module". These hash sets are functionally equivalent to local hash sets but can be shared among multiple analysts (when using a PostgreSQL central repository). \section cr_terms Terms and Concepts - Central Repository - The Autopsy feature containing the central repository database and Correlation Engine Ingest Module. Also responsible for displaying correlated properties to the user - Central Repository Database - the SQLite or PostgreSQL database that holds all the data - Correlation Engine Ingest Module - The ingest module responsible for adding new properties to the database and comparing these properties against existing notable properties - Property - The data being stored/correlated. These can be file paths/MD5 hashes, email addresses, phone numbers, etc. \section cr_setup Setup To start, open the main options panel and select the "Central Repository" icon. \image html central_repo_options.png \subsection cr_db_setup Setting up the Database On the central repository options panel, check the 'Use a Central Repository' option and then click the Configure button to set up a database. There are two options here: - SQLite - This option stores the database in a file. It should only be used when a single client will be accessing the database. - PostgreSQL - This option uses a database server running either on the user's host or a remote server. This option must be used if multiple users will be using the same database. Once a database has been configured, the lower two buttons on the main panel will be enabled, which will be described below. Setting up PostgreSQL Deployment If needed, see the \ref install_postgresql_page for help setting up your PostgreSQL server. For PostgreSQL all values are required, but some defaults are provided for convenience. \image html central_repo_postgres.png - Host Name/IP is the hostname or IP of your PostgreSQL server. - Port is the port that the PostgreSQL server is listening on; default is 5432. - User Name is a PostgreSQL user that can create and modify databases - User Password is the password for the user. If the database does not exist, you wll be prompted to create it. Setting Up SQLite Deployment Select SQLite in the Database Type to set up a SQLite database. SQLite databases should not be used if more than one client will be accessing the central repository. \image html central_repo_sqlite.png Enter or browse to a folder for the database. If the database file does not exist in that folder, you will be prompted to create it. \subsection cr_manage_properties Manage Correlation Properties The Correlation Engine ingest module can save different types of properties to the database. By default all properties are recorded, but this setting can be changed on the options panel through the Manage Correlation Properties button. Note that these settings are saved to the database, so in a multi-user setting any changes will affect all users. \image html central_repo_types.png Descriptions of the property types: - Files - Files are correlated based on MD5 hash and file path and name. The Hash Lookup ingest module must be enabled. - Domains - Domains are extracted from the various web artifacts, which primarily come from the Recent Activity module - Email Addresses - Email addresses are pulled from Email Address hits from the Keyword Search module. - Phone Numbers - Phone numbers are currently only extracted from call logs, contact lists and message, which come from the Android Analyzer module. - USB Devices - USB device properties come from the registry parsing in the Recent Activity Module. - Wireless Networks - Wireless networks are correlated on SSIDs, and come from the registry parsing in the Recent Activity Module. - MAC Addresses - MAC address properties are currently only created by custom Autopsy modules - IMEI Number - IMEIs properties are currently only created by custom Autopsy modules - IMSI Number - IMSI properties are currently only created by custom Autopsy modules - ICCID Number - ICCID properties are currently only created by custom Autopsy modules \subsection cr_manage_orgs Manage Organizations Organizations are stored in the central repository and contain contact information for the given organization. Organizations are used for Hash Sets saved in the central repository, and can also be associated with Autopsy cases. \image html central_repo_orgs.png One default org, "Not Specified" will always be present in the list. New organizations can be created, edited, and deleted through the appropriate buttons. Note that any organization that is currently in use by a case or hash set can not be deleted. All fields apart from the organization name are optional. \image html central_repo_new_org.png \subsection cr_show_cases Manage Cases Displays a list of all cases that are in the central repository database and details about each case. \image html central_repo_details.png \section cr_using_repo Using the Central Repository \subsection cr_ingest_module Correlation Engine Module The Correlation Engine ingest module is responsible for adding properties to the database and comparing each property against the list of notable properties. It is best to run all ingest modules to get the most out of the Correlation Engine. For example, if Hash Lookup is not run then the Correlation Engine module will not put any files into the database. If the Correlation Engine module is not run on a particular case but a central repository is enabled, there will still be some limited functionality. The Content Viewer will still display matching properties from other cases/data sources where the Correlation Engine was run. \image html central_repo_ingest_settings.png There are three settings for the Correlation Engine ingest module: