Zone.Identifier (Mark of the Web)

What it is

When a browser, e-mail client or other application using the Windows Attachment Manager saves a file that came from the internet, it attaches a small text alternate data stream named Zone.Identifier to it. This is the Mark of the Web (MOTW): Windows uses it to show "This file came from another computer" warnings, trigger SmartScreen, and open Office documents in Protected View or block their macros. For investigators, the stream records the security zone of origin and, with modern browsers, the exact download URL and referring page.

Location

Typical content:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://example.org/downloads/
HostUrl=https://cdn.example.org/files/setup.zip

The stream is small, so it is usually resident in the MFT record and survives in the $MFT even when the file content is gone.

What it proves

• Origin: the file was saved from a zone other than the local machine, usually the Internet (ZoneId 3).
• Source URL: HostUrl is the URL the file was downloaded from; ReferrerUrl the page that led to it. Chromium-based browsers (Chrome, Edge) write both; Firefox has done so since version 67 outside private browsing.
• Delivery technique: HostUrl=about:internet or a blob: URL points to files generated in the browser, typical of HTML smuggling.
• It does not prove the file was opened or executed, and its absence does not prove the file was created locally (see Retention).

Key fields

Timestamps

Retention and clearing

• The stream lives as long as the file on NTFS. It is lost when the file is copied to FAT32/exFAT, sent through some transfer channels, or rebuilt by a program that does not preserve streams.
• "Unblock" in file properties and Unblock-File in PowerShell delete the stream; removal is visible as a stream change in the USN journal.
• Propagation to extracted files depends on the tool: Windows' built-in ZIP extraction propagates the mark; 7-Zip added an option to do it in version 22.00; many other archivers do not.
• Container formats have been used to strip the mark: until the November 2022 security update (CVE-2022-41091), files inside a mounted ISO did not inherit it. Downloads by command-line tools, scripts or SMB copies often carry no mark at all.
• Private-browsing sessions may omit URLs.

Collection

• KAPE target: $MFT. There is no dedicated target for Zone.Identifier: resident streams are captured in the $MFT. Non-resident streams (unusually long content) require collecting the files themselves.
• Velociraptor (Windows.Triage.Targets): $MFT. For live hunting, Windows.Analysis.EvidenceOfDownload lists files with ZoneId 3 or 4 and their stream content, and Windows.NTFS.ADSHunter searches alternate data streams by name and content.
• Built-in:

Get-Item C:\Users\alice\Downloads\* -Stream Zone.Identifier -ErrorAction SilentlyContinue | Select-Object FileName, Length
Get-Content C:\Users\alice\Downloads\invoice.iso -Stream Zone.Identifier

dir /r C:\Users\alice\Downloads
more < C:\Users\alice\Downloads\invoice.iso:Zone.Identifier

Parsing tools

• MFTECmd (Eric Zimmerman, free): the $MFT CSV includes a ZoneIdContents column with the text of resident Zone.Identifier streams.
• Streams (Sysinternals, free): lists alternate data streams recursively (streams -s).
• Velociraptor: Windows.Analysis.EvidenceOfDownload and Windows.NTFS.ADSHunter.
• PowerShell: Get-Item -Stream and Get-Content -Stream for quick live review.
• Sysmon: event ID 15 (FileCreateStreamHash) logs the creation of the stream when Sysmon is deployed.

Investigation tips

• Filter the MFTECmd output on ZoneIdContents to list every file downloaded from the internet, then pivot on HostUrl domains to find the initial payload and correlate with browser artifacts.
• Look for about:internet or blob: host URLs: they indicate files assembled in the browser, a common HTML smuggling technique.
• Check ISO, IMG, VHD and archive files in Downloads, then look for their extracted contents without a mark: a sign of MOTW evasion.
• A Zone.Identifier on an .exe, .js, .hta or .lnk that later appears in Prefetch or Microsoft Defender logs ties execution back to its download source.
• Files in $Recycle.Bin keep their stream, so deleted downloads can still show their origin.
• Absence of the mark is not proof of local creation; consider the file system, the transfer method and the archiver used.