BergssonForensics.
Menu
← Back to catalogue
Files & changes

Zone.Identifier / Mark of the Web

Windows may attach origin-zone metadata to a downloaded file in an alternate data stream. A retained stream can add acquisition context but is not a cryptographic identity or a complete download history.

Listen to the full guide

Download MP32 min · AI narration

Useful for

Support retained zone/origin metadata attached to that file.

Important limit

Prove execution, harmlessness or authenticity.

Location & availability

An NTFS file’s Zone.Identifier alternate data stream

Creation and propagation depend on downloader, archive tool, filesystem and Windows version.

Fields to examine

  • ZoneId and available HostUrl or ReferrerUrl values.
  • The exact file carrying the stream.
  • Filesystem and acquisition method that preserved alternate streams.

What it can establish

  • Support retained zone/origin metadata attached to that file.

What it cannot prove

  • Prove execution, harmlessness or authenticity.
  • Infer that a file was never downloaded when the stream is missing.

Use it in a screenshare

  1. Preserve the file using a method that retains alternate data streams.
  2. Read the stream as text on a copy; do not launch the file or remove its block flag. Record absent fields explicitly.
  3. Compare origin hints with browser download records and the file hash. Account for archive extraction, copying and non-NTFS destinations.

Worked example

A file has internet-zone metadata and a release URL hint. This is useful acquisition context, but the URL text does not authenticate the bytes or establish who downloaded or ran them.

Cross-check the finding

  • Browser download records →Support a recorded transfer attempt and, when recorded, its completion state.
  • $MFT →Support the presence and recorded metadata of a particular file record.
  • Prefetch →Support execution of an associated executable within the retained history.

Sources

Choose another artefact →