Summary
You download a normal-looking PDF, image, or software installer from the web. You open File Explorer, check its size and icon, and there’s nothing obvious separating it from a file you created yourself. There may be one difference, though. Files saved from the internet through your browser and many other Windows apps can carry metadata that File Explorer doesn’t normally show you. Windows and other applications can later read that information when you open or run the file, which helps explain some of those security warnings that seem to appear out of nowhere. Not every method of getting a file onto your PC adds this metadata, but ordinary browser downloads are where you’re most likely to encounter it. What Windows secretly attaches to downloaded files There’s more attached to that file than you can see The underlying technology is called NTFS Alternate Data Streams, or ADS. An NTFS file can contain its normal data stream, which holds the actual contents you expect, along with additional named streams attached to the same file. Those extra streams don’t show up as separate files, and their contents aren’t included in the file size File Explorer normally reports. Browsers and other Windows apps can use this capability to attach a stream named Zone.Identifier when saving a file from an untrusted source. Windows commonly uses that stream to store the Mark of the Web, or MotW. You can see it yourself without installing anything. Open Command Prompt, navigate to your Downloads folder, and run: dir /r A tagged file may have another line underneath it that looks like this: yourfile.exe:Zone.Identifier:$DATA PowerShell can go one step further and show you what’s inside: Get-Content .\yourfile.exe -Stream Zone.Identifier On a typical browser download, you might get something along these lines: [ZoneTransfer] ZoneId=3 ReferrerUrl=https://www.google.com/ HostUrl=https://example.com/file.exe ZoneId records the Windows security zone associated with the file. The values run from 0 for the local computer through 1 for Local Intranet, 2 for Trusted Sites, 3 for Internet, and 4 for Restricted Sites. For a normal web download, ZoneId=3 is the one you’re most likely to find. That number doesn’t mean Windows has decided the file is malicious. It simply records that the file came from the Internet zone, giving other software useful context when deciding what to do with it. Depending on the browser or app that created the stream, you may also see HostUrl and ReferrerUrl . These can record where the download came from and the page that led you there, although they aren’t guaranteed to appear on every tagged file. It gives Zone.Identifier a second life as a small forensic record attached directly to the download. That tiny tag changes how Windows treats the file A few hidden lines can change the whole welcome Zone.Identifier doesn’t scan a file or calculate whether it’s trustworthy. It just records its origin. Other Windows components and applications can then use that information when deciding how to handle the file. Some of the places you’re most likely to encounter its effects include:
- File Properties warnings: Right-click certain downloaded files, open Properties, and you may find a message near the bottom saying, “This file came from another computer and might be blocked to help protect this computer.” That warning is tied to the file’s stored zone information.
Microsoft Defender SmartScreen: Windows’ App & browser control includes SmartScreen protection against suspicious downloads. SmartScreen can apply reputation checks when you run downloaded apps and installers. Its decision involves far more than theZone.Identifier stream itself, including signals such as the file’s hash, digital signature, or publisher reputation, and download history. The internet-origin information tells Windows that the executable arrived as a download. - Microsoft Office: Documents from potentially unsafe locations can open in Protected View with editing and active content restricted. Modern Microsoft 365 versions also block VBA macros by default when an Office file carries Mark of the Web from the Internet zone. This caution has a practical reason: malicious Excel attachments can spread fileless malware. - PowerShell execution policies: Under policies such as RemoteSigned , an unsigned script downloaded from the internet won’t normally run until it’s signed or explicitly unblocked. That also explains the Unblock checkbox in a file’s Properties window. Selecting it doesn’t scan the file and decide it’s safe. Instead, Windows removes the Mark of the Web information. PowerShell can do the same thing: Unblock-File .\yourfile.exe Internally, Unblock-File removes the Zone.Identifier alternate data stream. The file’s normal contents remain unchanged, but software that depends on MotW can no longer see it as an internet-originated file. Keep that in mind before treating Unblock as a shortcut around an annoying warning. Removing the tag removes security context, not whatever risk may exist inside the file. Several familiar file types are often used to hide viruses, so Microsoft recommends verifying the file and its source before unblocking it. If you’re still unsure about a download, Windows Sandbox gives you an isolated place to test suspicious files on supported editions of Windows rather than immediately running them on your normal desktop. The tag can disappear more easily than you’d expect Its memory gets fuzzy once the file starts traveling Mark of the Web only works while the filesystem and software handling the file preserve it. In practice, what happens to the tag depends heavily on what you do with the file. | What you do with the file | What happens to Mark of the Web | |---|---| | Rename it on an NTFS drive | The | | Move it elsewhere on the same NTFS volume | The stream stays attached to the file. | | Copy it to FAT32 or exFAT | The NTFS alternate data stream can’t be preserved in the same form, so the tag is lost if the copy proceeds. | | Extract a downloaded ZIP with Windows | Windows can propagate the archive’s internet-origin information to files extracted from it. | | Extract it with a third-party archiver | Behavior depends on the app and version; bugs have allowed extracted files to lose the tag. | | Use Unblock or Unblock-File | Windows removes the | The filesystem boundary is one of the easiest ways to see how fragile the mechanism can be. Renaming a tagged file on an NTFS drive won’t remove its Zone.Identifier stream, and moving it somewhere else on the same NTFS volume won’t either. If you copy it to a FAT32 or exFAT drive, though, those filesystems can’t preserve the NTFS alternate data stream in the same form. Windows may warn that some file properties can’t be copied, then continue without them. Archives make the situation more interesting. If you download a ZIP file, the archive itself can carry Mark of the Web. When Windows extracts its contents, that origin information can propagate to the files inside, which prevents compression from becoming an easy way around protections that depend on it. Third-party archive utilities don’t always handle that metadata correctly, though, and bugs have occasionally caused it to disappear during extraction. A good example is CVE-2025-0411, a vulnerability disclosed in 7-Zip. Certain older versions could fail to propagate the Mark of the Web when extracting files from specially crafted nested archives. A malicious payload could then emerge without the internet-origin marker Windows normally uses to decide whether to show extra warnings. The issue was fixed in 7-Zip 24.09. Windows has been hiding useful information in plain sight Alternate Data Streams have been part of NTFS since the early Windows NT era, with early uses including compatibility with Macintosh-style file forks. Decades later, the same mechanism gives Windows a simple place to record where downloaded files came from. Most of the time, you’ll never need to inspect a Zone.Identifier stream yourself. Still, knowing it exists makes several familiar Windows behaviors much less mysterious. The warning on an installer, an Office document opening in Protected View, or an unsigned PowerShell script refusing to run can all trace back, at least in part, to a few lines of metadata sitting invisibly beside the file you downloaded.