Zone Identifier - Is your file downloaded from the internet?

Have you ever wondered, why your file is not working after downloading it from the internet? How does system know if the file is downloaded from the internet?

The answers to this is Zone.Identifiers.

What are Zone Identifiers?

Zone Identifiers is an alternate data stream that points, from where the file came on the users' computer.

Note: Alternate Data Streams are included with files on WIndows. This is typically the case with downloaded and blocked files.

It has multiple values associated with it -

So, sometimes it might happen, that some of the functionalities of the file are not enabled by default, because the file is downloaded from the internet. So, in order to access that specific function, we have to delete the zone.identifier of the file.

Analysis

To get all the alternate data streams -

PS C:\Users\Cardinal\Test> Get-Item file.xlsm -Stream *


PSPath        : file.xlsm::$DATA
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\Users\Cardinal\Test
PSChildName   : file.xlsm::$DATA
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\Users\Cardinal\Test\file.xlsm
Stream        : :$DATA
Length        : 2885946

PSPath        : file.xlsm:Zone.Identifier
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\Users\Cardinal\Test
PSChildName   : file.xlsm:Zone.Identifier
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\Users\Cardinal\Test\file.xlsm
Stream        : Zone.Identifier
Length        : 50

The above mentioned files contains two data streams - $DATA and Zone.Identifier.

How to read a alternate data stream?

We will see how to read a alternate data stream, in this case we will be looking at Zone Identifiers.

PS C:\Users\Cardinal\Test>  Get-Item file.xlsm | Get-Content -Stream Zone.Identifier
[ZoneTransfer]
ZoneId=3
HostUrl=about:internet

Here the ZoneId is mentioned as 3 which specifies that the file is downloaded from the internet.

Now, this is being used to implement security features, like do not execute macros in the excel file because the file is not from a trusted source (from the internet).

But in order to open the file and use macros, we have to delete the zone identifier from the file, the below process will help in doing so -

PS C:\Users\Cardinal\Test>  Unblock-File file.xlsm

It will delete the zone identifier and the macros will be enabled in the excel file.

More?

Here are a few links for you to read, which have some interesting and related content about the topic -

• Forensics Analysis of Zone Identifier Stream
• Windows ::DATA Alternate Data Stream

Until next time, cheers!