You may have downloaded a file weeks ago and want to find out where it was downloaded from. You may determine that by reading the alternate data streams for that file. When you download a file and save the file in an NTFS volume, the zone information for the file is stored in the NTFS alternate data streams (ADS).
The alternate data streams contain the ZoneID, HostUrl, and ReferrerUrl.
RELATED: How to Bulk Unblock Files Downloaded from the Internet
Determine where a File was Downloaded from
The ADS info will be intact unless you use the “unblock” option in the file’s properties or move the file to a FAT32 volume.
First, check if the downloaded file’s zone ID is intact. To do so, open Command Prompt and switch to the folder that contains the file.
(Let’s say the file name is “WebBrowserPassView.zip”.)
To see if the zone identifier is intact, run:
dir /r
Zone.Identifier:$DATA
entry corresponding to a file, it means the zone ID for that file is intact. See the screenshot below.
To read the ZoneID, HostUrl, and ReferrerUrl fields in that file, use one of the following methods.
Option 1: Using Notepad
Now, to read the zone ID for the file “WebBrowserPassView.zip”, type:
notepad webbrowserpassview.zip:Zone.Identifier
There you see the ZoneId, ReferrerUrl, and the HostUrl.
Option 2: Using the “More” command
Type:
more < WebBrowserPassView.zip:Zone.Identifier
The above command shows the required information in the console screen itself.
Option 3: Using PowerShell
You can also view the zone ID information in PowerShell.
Switch to the directory that contains the file, and then run:
get-content -path "webbrowserpassview.zip" -stream zone.identifier
The “ZoneID” value may be 2, 3, or 4. Internet zone is “2”, Intranet zone is “3”, and Restricted sites is 4. “HostUrl” is the direct download URL from where the file was downloaded. “ReferrerUrl” is the referrer page from where you clicked the download link.
One small request: If you liked this post, please share this?
One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!