Zone Identifier - Is your file downloaded from the internet?

Have you ever wondered, why your file is not working after downloading it from the internet? How does system know if the file is downloaded from the internet?

The answers to this is Zone.Identifiers.

What are Zone Identifiers?#

Zone Identifiers is an alternate data stream that points, from where the file came on the users’ computer.

Note: Alternate Data Streams are included with files on WIndows. This is typically the case with downloaded and blocked files.

It has multiple values associated with it -

Value	Zone
0	File created on the same computer
1	Local Intranet Zone - Files downloaded from the local network.
2	Trusted Zone - Trusted websites on the internet.
3	Internet Zone - File Downloaded from the internet.
4	Restricted Sites Zone

So, sometimes it might happen, that some of the functionalities of the file are not enabled by default, because the file is downloaded from the internet. So, in order to access that specific function, we have to delete the zone.identifier of the file.

Analysis#

To get all the alternate data streams -

powershell
PS C:\Users\Cardinal\Test> Get-Item file.xlsm -Stream *


PSPath        : file.xlsm::$DATA
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\Users\Cardinal\Test
PSChildName   : file.xlsm::$DATA
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\Users\Cardinal\Test\file.xlsm
Stream        : :$DATA
Length        : 2885946

PSPath        : file.xlsm:Zone.Identifier
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\Users\Cardinal\Test
PSChildName   : file.xlsm:Zone.Identifier
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\Users\Cardinal\Test\file.xlsm
Stream        : Zone.Identifier
Length        : 50

The above mentioned files contains two data streams - $DATA and Zone.Identifier.

How to read a alternate data stream?#

We will see how to read a alternate data stream, in this case we will be looking at Zone Identifiers.

powershell
PS C:\Users\Cardinal\Test>  Get-Item file.xlsm | Get-Content -Stream Zone.Identifier
[ZoneTransfer]
ZoneId=3
HostUrl=about:internet

Here the ZoneId is mentioned as 3 which specifies that the file is downloaded from the internet.

Now, this is being used to implement security features, like do not execute macros in the excel file because the file is not from a trusted source (from the internet). Zone Identifier Macros Disabled Example

But in order to open the file and use macros, we have to delete the zone identifier from the file, the below process will help in doing so -

powershell
PS C:\Users\Cardinal\Test>  Unblock-File file.xlsm

It will delete the zone identifier and the macros will be enabled in the excel file.

More?#

Here are a few links for you to read, which have some interesting and related content about the topic -

Until next time, cheers!