How to Determine where a File was Downloaded from

You may have downloaded a file weeks ago and want to find out where it was downloaded from. You may determine that by reading the alternate data streams for that file. When you download a file and save the file in an NTFS volume, the zone information for the file is stored in the NTFS alternate data streams (ADS).

The alternate data streams contain the ZoneID, HostUrl, and ReferrerUrl.

RELATED: How to Bulk Unblock Files Downloaded from the Internet

Determine where a File was Downloaded from

The ADS info will be intact unless you use the “unblock” option in the file’s properties or move the file to a FAT32 volume.

First, check if the downloaded file’s zone ID is intact. To do so, open Command Prompt and switch to the folder that contains the file.

(Let’s say the file name is “WebBrowserPassView.zip”.)

To see if the zone identifier is intact, run:

dir /r
If the directory listing shows the Zone.Identifier:$DATA entry corresponding to a file, it means the zone ID for that file is intact. See the screenshot below.

To read the ZoneID, HostUrl, and ReferrerUrl fields in that file, use one of the following methods.

Option 1: Using Notepad

Now, to read the zone ID for the file “WebBrowserPassView.zip”, type:

notepad webbrowserpassview.zip:Zone.Identifier

zone identifier open in notepad

There you see the ZoneId, ReferrerUrl, and the HostUrl.




Option 2: Using the “More” command

Type:

more < WebBrowserPassView.zip:Zone.Identifier

zoneid and hosturl - ntfs alternate data streams

The above command shows the required information in the console screen itself.


Option 3: Using PowerShell

You can also view the zone ID information in PowerShell.

Switch to the directory that contains the file, and then run:

get-content -path "webbrowserpassview.zip" -stream zone.identifier

zone identifier - view in powershell -ADS

The “ZoneID” value may be 2, 3, or 4. Internet zone is “2”, Intranet zone is “3”, and Restricted sites is 4. “HostUrl” is the direct download URL from where the file was downloaded. “ReferrerUrl” is the referrer page from where you clicked the download link.


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

Leave a Comment