{"id":75762,"date":"2024-07-01T12:32:18","date_gmt":"2024-07-01T07:02:18","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=75762"},"modified":"2024-07-01T23:29:49","modified_gmt":"2024-07-01T17:59:49","slug":"find-where-file-downloaded-from","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/find-where-file-downloaded-from\/","title":{"rendered":"How to Determine where a File was Downloaded from"},"content":{"rendered":"

You may have downloaded a file weeks ago and want to find out where it was downloaded from. You may determine that by reading the alternate data streams for that file. When you download a file and save the file in an NTFS volume, the zone information for the file is stored in the NTFS alternate data streams (ADS).<\/p>\n

The alternate data streams contain the ZoneID<\/strong>, HostUrl<\/strong>, and ReferrerUrl<\/strong>.<\/p>\n

RELATED:<\/strong> How to Bulk Unblock Files Downloaded from the Internet<\/a><\/p>\n

Determine where a File was Downloaded from<\/h2>\n

The ADS info will be intact unless you use the “unblock” option in the file’s properties or move the file to a FAT32 volume.<\/p>\n

First, check if the downloaded file’s zone ID is intact. To do so, open Command Prompt and switch to the folder that contains the file.<\/p>\n

(Let’s say the file name is “WebBrowserPassView.zip”.)<\/em><\/p>\n

To see if the zone identifier is intact, run:<\/p>\n

dir \/r<\/pre>\n
\nIf the directory listing shows the Zone.Identifier:$DATA<\/strong><\/code> entry corresponding to a file, it means the zone ID for that file is intact. See the screenshot below.\n<\/div>\n
To read the ZoneID<\/strong>, HostUrl<\/strong>, and ReferrerUrl<\/strong> fields in that file, use one of the following methods.<\/p>\n
Option 1: Using Notepad<\/h3>\n
Now, to read the zone ID for the file “WebBrowserPassView.zip”, type:<\/p>\n
notepad webbrowserpassview.zip:Zone.Identifier<\/pre>\n
\"zone<\/p>\n
There you see the ZoneId, ReferrerUrl, and the HostUrl.<\/p>\n
\n
Option 2: Using the “More” command<\/h3>\n
Type:<\/p>\n
more < WebBrowserPassView.zip:Zone.Identifier<\/pre>\n
\"zoneid<\/p>\n
The above command shows the required information in the console screen itself.<\/p>\n
\n
Option 3: Using PowerShell<\/h3>\n
You can also view the zone ID information in PowerShell.<\/p>\n
Switch to the directory that contains the file, and then run:<\/p>\n
get-content -path \"webbrowserpassview.zip\" -stream zone.identifier<\/pre>\n
\"zone<\/p>\n
The “ZoneID” value may be 2, 3, or 4. Internet zone is “2”, Intranet zone is “3”, and Restricted sites is 4. “HostUrl” is the direct download URL from where the file was downloaded. “ReferrerUrl” is the referrer page from where you clicked the download link.<\/p>\n","protected":false},"excerpt":{"rendered":"
You may have downloaded a file weeks ago and want to find out where it was downloaded from. You may determine that by reading the alternate data streams for that file. When you download a file and save the file in an NTFS volume, the zone information for the file is stored in the NTFS … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[7],"tags":[396],"class_list":["post-75762","post","type-post","status-publish","format-standard","hentry","category-windows","tag-powershell"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":80511,"url":"https:\/\/www.winhelponline.com\/blog\/copy-this-file-without-properties-prompt\/","url_meta":{"origin":75762,"position":0},"title":"“Are you sure you want to copy this file without its properties” Prompt when Copying Files","author":"Ramesh","date":"March 18, 2026","format":false,"excerpt":"When you copy one or more files to a FAT32 partition on any disk (USB, HDD, or SSD), you're prompted to copy without preserving the properties. Here's the full message: Are you sure you want to copy this file without its properties? The file  has properties that can't be\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"Are you sure you want to copy this file without its properties?\" when coping files to USB flash disk","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/ntfs-to-fat32-ads-lost.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":3410,"url":"https:\/\/www.winhelponline.com\/blog\/bulk-unblock-files-downloaded-internet\/","url_meta":{"origin":75762,"position":1},"title":"How to Bulk Unblock Files Downloaded from Internet","author":"Ramesh","date":"July 5, 2016","format":false,"excerpt":"Files downloaded from the internet are marked with the Zone identifier (\"Mark of the Web\" stored as Alternate Data Streams) to trigger the application reputation check by Windows SmartScreen in Windows 8 and higher. This article explains how to bulk unblock multiple files downloaded from the internet. Zone Identification tagging\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"zoneid and hosturl - ntfs alternate data streams","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":10449,"url":"https:\/\/www.winhelponline.com\/blog\/bypass-smartscreen-even-if-its-enabled-through-group-policy\/","url_meta":{"origin":75762,"position":2},"title":"Bypass SmartScreen even if its Enabled through Group Policy","author":"Ramesh","date":"July 24, 2019","format":false,"excerpt":"When you download a file you downloaded from the internet, Windows adds the zone identifier or Mark of the Web as NTFS stream to the file. So, when you run the file, Windows SmartScreen checks if there is a zone identifier alternate data stream attached to the file. If the\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"bypass smartscreen even if policy enabled","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/bypass-smartscreen-5.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/bypass-smartscreen-5.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/bypass-smartscreen-5.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":79925,"url":"https:\/\/www.winhelponline.com\/blog\/file-explorer-previews-blocked-harm-your-computer\/","url_meta":{"origin":75762,"position":3},"title":"File Explorer: The file you are attempting to preview could harm your computer","author":"Ramesh","date":"December 5, 2025","format":false,"excerpt":"After installing the October 15 (2025), cumulative update for Windows 11, File Explorer turns off the preview feature for files downloaded from the internet. After the October 2025 or a later Windows security update is installed, the File Explorer preview pane will display the following message: The file you are\u2026","rel":"","context":"In "Windows 11"","block_context":{"text":"Windows 11","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-11\/"},"img":{"alt_text":"Internet Explorer options - Trusted sites zone","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/12\/ie-trusted-zone-sites.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":5576,"url":"https:\/\/www.winhelponline.com\/blog\/onedrive-demand-block-automatic-file-downloads\/","url_meta":{"origin":75762,"position":4},"title":"OneDrive Files On-Demand Downloads – Block and Unblock Apps via Settings","author":"Ramesh","date":"October 18, 2017","format":false,"excerpt":"OneDrive Files On-Demand, a new feature which is essentially like OneDrive placeholders, has been made available with the release of Windows 10 Fall Creators Update. OneDrive Files On-Demand feature which is enabled by default, allows you to set a file or folder available \"online only\". These \"online\" files in your\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"onedrive on-demand online file","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/onedrive-on-demand-cloud-only-file.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/onedrive-on-demand-cloud-only-file.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/onedrive-on-demand-cloud-only-file.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":1668,"url":"https:\/\/www.winhelponline.com\/blog\/sort-by-date-modified-folders-on-top\/","url_meta":{"origin":75762,"position":5},"title":"How to Sort by Date Modified (Descending) With Folders On Top?","author":"Ramesh","date":"February 20, 2016","format":false,"excerpt":"In any version of Windows, when you sort items in a folder in descending order by Date Modified column, folders move to the bottom, and files go to the top. However, users may want to sort folders separately and have them remain at the top and files below. For example,\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/w10\/sort-reverse-folder-top-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/w10\/sort-reverse-folder-top-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/w10\/sort-reverse-folder-top-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/75762","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=75762"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/75762\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=75762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=75762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=75762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}