Windows records where you download files from (how to see it)

iGuRu.gr > Windows records where you download files from (how to see it)

Yes, you can read the “Mark of the Web” information from files present in Windows 11 to find out where they were downloaded from and decide if it is safe to open them.

Too many people download files from the internet all the time. And while Windows Defender usually detects a malicious file before it causes problems, no security software is perfect. That's one reason why Windows logs the origin of some files and can handle files downloaded from the internet more carefully. web mark

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

Windows has a feature called “Mark of the Web.” When a file comes from the Internet or another potentially unsafe location, Windows can attach information to it that tells the operating system and supported applications where it came from. Windows can then use this information to display warnings or impose additional restrictions.

You've probably seen this in action before, without even knowing it. Microsoft warns you about opening files from an untrusted source, requiring you to give permission to open the file. This is partly due to the “Mark of the Web.”

How to check for the presence of “Mark of the Web” in Windows 11 files

To see if a file is marked as “Mark of the Web,” right-click the file and select “Properties.” Then, look at the bottom of the “General” tab. If Windows thinks the file came from another computer, you’ll see a security warning that says the file may be blocked to protect your computer. Next to it, there should be a check box that says “Unblock.”

If you select “Unblock,” click “Apply,” and then click “OK,” Windows removes the “Mark of the Web” information from the file. This will eliminate any additional warnings or restrictions that Windows places on downloaded files. Due to the nature of this action, you should be sure to only unblock files that you fully trust.

Checking a file's properties confirms the existence of the “Mark of the Web” mark, but there is another way to find more information about the file's origin.

The “Mark of the Web” is stored using an Alternate Data Stream of the NTFS file system, which is called `Zone.Identifier`.

You can access this identifier with a simple command, and depending on the information stored with the file, you will be able to determine where it was downloaded from and what its designated security zone is in Windows.

Microsoft Windows 11 26H2 official ISO for everyone

How can you do it:

Open Command Prompt or PowerShell in the folder containing the file
and run the command: `notepad filename.ext:Zone.Identifier` Replace `filename.ext` with the actual file name).
If the file has the “Mark of the Web” label, Notepad will display a text that may contain information such as: `[ZoneTransfer]`, `ReferrerUrl=…`, `HostUrl=…`, `ZoneId=3`.

The `ReferrerUrl` field usually indicates the download website, while the `HostUrl` indicates the URL from which the file was downloaded. However, not all files contain both fields, as this depends on the application or browser that created the “Mark of the Web”.

When it comes to `ZoneId`, Windows uses different numbers to represent security zones. Zone 0 corresponds to “My Computer”, Zone 1 to Local Intranet, Zone 2 to Trusted sites, Zone 3 to “Internet”, and Zone 4 to “Restricted sites”. So if you see `ZoneId=3`, Windows thinks the file came from the Internet.

This explains why Windows treats one file differently than another.

There is, however, one important detail: the fact that a file does not have the “Mark of the Web” does not necessarily mean that it was never downloaded from the Internet. Information can be lost when a file is copied to a file system that does not support NTFS Alternate Data Streams.