# File Extension Mismatch setup

**URL:** <https://sleuthkit.discourse.group/t/file-extension-mismatch-setup/2223>\
**Category:** Autopsy Help\
**Created:** [October 15, 2020, 4:25pm UTC](https://sleuthkit.discourse.group/t/file-extension-mismatch-setup/2223 "2020-10-15T16:25:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bood](https://avatars.discourse-cdn.com/v4/letter/b/919ad9/32.png) [@bood](https://sleuthkit.discourse.group/u/bood)\
**Post date:** [October 15, 2020, 4:25pm UTC](https://sleuthkit.discourse.group/t/file-extension-mismatch-setup/2223/1 "2020-10-15T16:25:46Z")

</div>

I started an ingest yesterday on my local Documents directory. It has a lot of images in it, and the total size is 123 GB (90,752 files). I started it around 2pm, and it was only 45% done at 8am this morning… Does this sound normal?

Anyway, I cancelled it, as it had already collected a lot of information.

I looked at the “Extension Mismatch Detected”, and I saw one was ‘thm’. I looked it up and it is a thumbnail, and should really be (as Autopsy reported) MIME type ‘jpeg’. Another one was a Canon Raw file with extension ‘CR2’.

I figured since Autopsy knows about these files, there should be a way to configure it to not report these as a mismatch.

It looks like one way to do this would be to simply add extension ‘thm’ as another “known” type for image/jpeg. Is this the correct way to prevent ‘thm’ from showing up as a mismatch?

Also, online I read that CR2 is really a type of image/tiff. I thought about doing the same thing, but then I read that there is a mime type called ‘image/x-canon-cr2’. I also have the older Canon CR raw files.

WHat is the recommended way to have these not be detected as mismatches?

Thanks,

Mitch

---

<div class="post-metadata">

**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\
**Post date:** [October 24, 2020, 4:41pm UTC](https://sleuthkit.discourse.group/t/file-extension-mismatch-setup/2223/2 "2020-10-24T16:41:23Z")

</div>

> [@bood](#):
>
> I started it around 2pm, and it was only 45% done at 8am this morning… Does this sound normal?

That _can_ be normal, but it depends entirely on the ingest modules you selected. The keyword module is lengthy, so don’t run it if you don’t need it. You can also create a file filter in the **Options | Ingest** tab to focus keyword indexing (and/or other ingest modules) on a subset of data, e.g., in the ‘/Users/’ and ‘/$Recycle.Bin/’ directories.

Also bear in mind that eliminating known files through the NSRL hash sets can shorten ingest time.

> [@bood](#):
>
> It looks like one way to do this would be to simply add extension ‘thm’ as another “known” type for image/jpeg. Is this the correct way to prevent ‘thm’ from showing up as a mismatch?

If you wanted to stop thm files that have jpeg signatures from appearing as mismatches, then add the ‘thm’ extension to **Options | File Extension Mismatch**. Select ‘image/jpeg’ in the File Types pane and then add ‘thm’ as a new extension.

> [@bood](#):
>
> WHat is the recommended way to have these not be detected as mismatches?

Repeat the process above for any file that you don’t want reported as a mismatch. Find the MIME type in the **Options | File Extension Mismatch** tab and enter the file extension you _don’t want reported_ for that MIME type.

Remember the purpose of the analysis category: to alert the examiner of _potentially_ disguised files.

---

<div class="post-metadata">

**Author:** ![bood](https://avatars.discourse-cdn.com/v4/letter/b/919ad9/32.png) [@bood](https://sleuthkit.discourse.group/u/bood)\
**Post date:** [October 24, 2020, 4:53pm UTC](https://sleuthkit.discourse.group/t/file-extension-mismatch-setup/2223/3 "2020-10-24T16:53:06Z")

</div>

John,

Thanks for your reply!

Mitch