Autopsy User Documentation  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Central Repository

Table of Contents


The central repository allows a user to find matching artifacts both across cases and across data sources in the same case. It is a combination of an ingest module that extracts, stores, and compares properties against lists of notable properties, a database that stores these properties, and an additional panel in Autopsy to display other instances of each property. The central repository database can either be SQLite or PostgreSQL.

The following are some use cases for the central repository:

Terms and Concepts


The central repository settings are found on the main options panel (Tools->Options) on the "Central Repository" tab.


Database Configuration

There are two types of central repository databases:

Automatic Database Configuration

Starting with Autopsy 4.15, when you load Autopsy and the central repository is not enabled you will be asked if you want to enable it. Doing so will create a SQLite database in your Autopsy user folder (on Windows this will be in AppData). You will only be prompted to do this once. Whichever option you select, you can change your central repository settings later as described below.

Since a SQLite database can't be used for multi-user cases, you are also given the option to switch to a PostgreSQL database when you enable multi-user cases. If you are currently using a SQLite database, when you enable multi-user cases you will be asked if you want to switch to a PostgreSQL database on the same server. Note that the contents of your SQLite database will not be copied over.

Manual Database Configuration

On the central repository options panel, check the 'Use a Central Repository' option and then click the Configure button to set up a database. There are three options here:

Once a database has been configured, the lower two buttons on the main panel will be enabled, which will be described below.

Setting up a PostgreSQL deployment using the multi-user settings

See the Setting Up Multi-user Cluster page for instructions on configuring a multi-user environment. Once done, you can select the "PostgreSQL using multi-user settings" option to create/use a central repository on that PostgreSQL server.

Setting up a custom PostgreSQL deployment

If needed, see the Install and Configure PostgreSQL page for help setting up your PostgreSQL server.

For PostgreSQL all values are required, but some defaults are provided for convenience.


If the database does not exist, you wll be prompted to create it.

Setting Up SQLite Deployment

Select SQLite in the Database Type to set up a SQLite database. SQLite databases should not be used if more than one client will be accessing the central repository.


Enter or browse to a folder for the database. If the database file does not exist in that folder, you will be prompted to create it.

Manage Correlation Properties

The Central Repository ingest module can save different types of properties to the database. By default all properties are recorded, but this setting can be changed on the options panel through the Manage Correlation Properties button. Note that these settings are saved to the database, so in a multi-user setting any changes will affect all users.


Descriptions of the property types:

Manage Organizations

Organizations are stored in the central repository and contain contact information for the given organization. Organizations are used for Hash Sets saved in the central repository, and can also be associated with Autopsy cases.


One default org, "Not Specified" will always be present in the list. New organizations can be created, edited, and deleted through the appropriate buttons. Note that any organization that is currently in use by a case or hash set can not be deleted. All fields apart from the organization name are optional.


Manage Cases

Displays a list of all cases that are in the central repository database and details about each case.


Using the Central Repository

Central Repository Module

The Central Repository ingest module is responsible for adding properties to the database and comparing each property against the list of notable properties. It is best to run all ingest modules to get the most out of the Correlation Engine. For example, if Hash Lookup is not run then the Central Repository module will not put any files into the database. If the Central Repository module is not run on a particular case but a central repository is enabled, there will still be some limited functionality. The Content Viewer will still display matching properties from other cases/data sources where the Central Repository was run.


There are three settings for the Central Repository ingest module:

Tagging Files and Artifacts

Tagging a file or artifact with a "notable" tag will change its associated property in the central repository to notable as well. By default, there will be a tag named "Notable Item" that can be used for this purpose. See the Tagging page for more information on creating additional tags with notable status. Any future data source ingest (where this module is enabled) will use those notable properties in a similar manner as a Known Bad hash set, causing matching files and artifacts from that ingest to generate Previously Notable analysis results in that future case.


If a tag is accidentally added to a file or artifact, it can be removed though the context menu. This will remove its property's notable status in the central repository.

If you would like to prevent the analysis results from being created in a particular case, you can disable the flagging through the run time ingest properties. Note that this only disables the analysis results - all properties are still added to the central repository unless the top checkbox in the ingest properties is unselected.


Viewing Results

Results from enabling a central repository and running the Central Repository Ingest Module can be seen in two places:

Content Viewer

The Content Viewer panel is where previous instances of properties are displayed. Without a central repository enabled, this "Other Occurrences" panel will show files with hashes matching the selected file within the current case. Enabling a central repository allows this panel to also display matching properties stored in the database, and adds some functionality to the row. Note that the Central Repository Ingest Module does not have to have been run on the current data source to see correlated properties from the central repository. If the selected file or artifact is associated by one of the supported Correlation Types, to one or more properties in the database, the associated properties will be displayed. Note: the Content Viewer will display ALL associated properties available in the database. It ignores the user's enabled/disabled Correlation Properties.

The other occurrences are grouped by case and then data source. Selecting one of the results brings up information on it in the right column. If a file or artifact was previously marked as notable, you will see "notable" in red next to "Known Status".


The user can click on any column heading to sort by the values in that column.

If the user selects an entry in the third column and then right-clicks, a menu will be displayed. This menu has several options.

  1. Export All Other Occurrences to CSV
  2. Show Case Details
  3. Show Frequency

Export All Other Occurrences to CSV

This option will save every other occurrence in the Content Viewer table to a CSV file. By default, the CSV file is saved into the Export directory inside the currently open Autopsy case, but the user is free to select a different location.

Show Case Details

This option will open a dialog that displays all of the relevant details for the selected case. The details will include:

These details would have been entered by the examiner of the selected case, when creating the case or later by visiting the Case -> Case Properties menu.

Show Frequency

This shows how common the selected file is. The value is the percentage of case/data source tuples that have the selected property.

Analysis Results

When this module is enabled, all of the enabled Correlatable Properties will cause matching files and artifacts to be added to the Analysis Results section of the tree during ingest. There are three types of analysis results that can be created:


Each type contains columns in the result viewer showing the correlation type and value that were compared with the central repository, and an "Other Cases" column listing every case the value was found in at the time of ingest (if applicable).


Copyright © 2012-2023 BasisTech. Generated on Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.