diff --git a/Core/src/org/sleuthkit/autopsy/modules/fileextmismatch/FileExtMismatchIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/fileextmismatch/FileExtMismatchIngestModule.java index 52a713eade..c9b25cf8d6 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/fileextmismatch/FileExtMismatchIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/fileextmismatch/FileExtMismatchIngestModule.java @@ -24,6 +24,7 @@ import java.util.Set; import java.util.logging.Level; import org.openide.util.NbBundle; import org.openide.util.NbBundle.Messages; +import org.python.icu.text.MessageFormat; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.coreutils.Logger; @@ -142,9 +143,13 @@ public class FileExtMismatchIngestModule implements FileIngestModule { addToTotals(jobId, System.currentTimeMillis() - startTime); if (mismatchDetected) { + String justification = MessageFormat.format("File has an extension of {0} but mime type is {1}", + abstractFile.getNameExtension(), detector.getMIMEType(abstractFile)); + // add artifact BlackboardArtifact bart = abstractFile.newAnalysisResult( - BlackboardArtifact.Type.TSK_EXT_MISMATCH_DETECTED, LIKELY_NOTABLE_SCORE, null, null, null, Collections.emptyList()) + BlackboardArtifact.Type.TSK_EXT_MISMATCH_DETECTED, LIKELY_NOTABLE_SCORE, + null, null, justification, Collections.emptyList()) .getAnalysisResult(); try {