From 7eff175af43f9aa65f5b887032945ed9378e4c34 Mon Sep 17 00:00:00 2001
From: Frank Xu <frank.w.xu@gmail.com>
Date: Thu, 22 Apr 2021 10:47:33 -0400
Subject: [PATCH] add file properties

---
 STIX_for_digital_forensics/readme.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/STIX_for_digital_forensics/readme.md b/STIX_for_digital_forensics/readme.md
index 0994b1e..06bb4dd 100644
--- a/STIX_for_digital_forensics/readme.md
+++ b/STIX_for_digital_forensics/readme.md
@@ -1772,6 +1772,10 @@ The auxiliary file extension specifies a default extension for capturing additio
 | content_tags      | list of strings | A list of words to describe the content of file.                       |
 | file_name         | string          | Specifies the file name.                                               |
 
+### Example
+
+A file is recovered using recovering software. The content of the file include rhino (images or string). The name of the file is generated by the recovering software, not the file name from original disk images.
+
 ```json
 {
   "type": "file",