> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/file-download/zone.identifier.md).

# Zone.Identifier

The `Zone.Identifier` alternate data stream (ADS) is a core component of Windows' Mark of the Web (MotW) security framework. When a file is downloaded from the Internet, Windows tags it with a hidden NTFS ADS named `Zone.Identifier` containing metadata about the file's origin. This tag is used by the operating system, Microsoft Office, SmartScreen, and other security features to warn users before opening potentially dangerous files. For forensic analysts, `Zone.Identifier` provides direct evidence that a file was downloaded from an external source and can reveal where it came from.

### How It Works

When a file is downloaded through a MotW-aware application, the Windows API function `IAttachmentExecute` writes a `Zone.Identifier` ADS to the file. This ADS is only preserved on NTFS volumes. Files moved to FAT32, exFAT, or network shares using non-NTFS file systems will lose the stream.

The `Zone.Identifier` stream is a plain-text INI-style file containing a `[ZoneTransfer]` section with one or more of the following fields:

```ini
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://example.com/downloads
HostUrl=https://cdn.example.com/file.exe
```

### ZoneId Values

| ZoneId                                | Zone Name                                     | Description                                                                                         |
| ------------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| 0                                     | MyComputer                                    | File originated from the local machine                                                              |
| 1                                     | Intranet                                      | File originated from the local intranet                                                             |
| 2                                     | Trusted                                       | File originated from a trusted site                                                                 |
| <mark style="color:$danger;">3</mark> | <mark style="color:$danger;">Internet</mark>  | <mark style="color:$danger;">File originated from the Internet (most common for downloads)</mark>   |
| <mark style="color:$danger;">4</mark> | <mark style="color:$danger;">Untrusted</mark> | <mark style="color:$danger;">File was flagged as suspicious (e.g., by Microsoft SmartScreen)</mark> |

ZoneId=3 is by far the most common value encountered during investigations and indicates a standard Internet download.

### Additional Fields

* **ReferrerUrl:** The URL of the page that initiated the download. This can reveal the website the user was visiting when the download occurred.
* **HostUrl:** The direct URL from which the file was downloaded. This is useful for tracing the exact source of a payload.
* **HostIpAddress:** In some cases, the IP address of the download host is recorded (primarily seen with downloads via Edge).

Not all applications populate all fields. The presence and completeness of these fields varies by browser and download method.

### Application Support

#### Applications That Set MotW

* **Modern browsers:** Microsoft Edge, Google Chrome, and Mozilla Firefox all tag downloaded files with `Zone.Identifier`. Edge and Chrome tend to populate both `ReferrerUrl` and `HostUrl`. Firefox populates `ReferrerUrl` but may not always include `HostUrl`.
* **Email clients:** Outlook tags attachments saved to disk.
* **Windows built-in:** Files downloaded via Windows Explorer (e.g., from network shares mapped to Internet zone).

#### Applications That Do NOT Set MotW

* **Command-line tools:** `curl.exe`, `wget`, `bitsadmin`, PowerShell's `Invoke-WebRequest` / `Invoke-RestMethod`, and `ftp.exe` do **not** apply the `Zone.Identifier` ADS by default. This is a critical gap. If an attacker downloads a payload using these tools, the file will lack MotW and will not trigger SmartScreen warnings.
* **Some third-party download managers and torrent clients** may not apply MotW.
* **Git clone operations** do not apply MotW to cloned files.

> <mark style="color:$danger;">**Forensic Implication**</mark>**:** The *<mark style="color:$danger;">**absence**</mark>* of a `Zone.Identifier` on a file that appears to have been downloaded can itself be an indicator. It may suggest the file was downloaded via a command-line tool, extracted from a container format that stripped MotW, or had its ADS deliberately removed.

### MotW Bypass Techniques (MITRE ATT\&CK T1553.005)

MotW bypasses are actively exploited in the wild and are directly relevant to DFIR investigations. Understanding these techniques helps explain why a downloaded malicious file may lack a `Zone.Identifier` or why SmartScreen did not trigger.

#### Container Format Bypasses

Certain container file formats do not properly propagate MotW to their contents when extracted:

* **ISO / IMG files:** When a user mounts an ISO or IMG file, the files inside are accessed via a virtual drive and do not inherit MotW. This technique has been heavily abused since Microsoft disabled Office macros by default for Internet-sourced documents in 2022. Threat actors commonly deliver malicious payloads inside ISO files attached to phishing emails.
* **VHD / VHDX files:** Same behavior as ISO files. Mounting a VHD bypasses MotW for files inside.
* **CAB files:** In some configurations, extracting CAB files does not propagate MotW.

#### Archive Tool Vulnerabilities

* **CVE-2025-0411 (7-Zip):** Versions before 24.09 did not propagate MotW to files within double-compressed archives (an archive inside an archive). Exploited as a zero-day by Russian threat actors against Ukrainian targets using SmokeLoader.
* **CVE-2024-8811 / CVE-2025-33028 (WinZip):** WinZip 29.x and earlier failed to propagate MotW to extracted files.
* **CVE-2024-38217:** A Windows vulnerability allowing MotW bypass through specially crafted archive files.
* **CVE-2024-38213:** Exploited by DarkGate operators to bypass SmartScreen using MotW manipulation.
* **CVE-2022-41091 / CVE-2022-44698:** Earlier MotW bypass vulnerabilities in Windows itself.

#### Deliberate MotW Removal

The `Zone.Identifier` ADS can be stripped from a file through built-in Windows mechanisms, third-party tools, or by directly deleting the alternate data stream. Once removed, it cannot be recovered unless a backup or forensic image preserved the original ADS. The absence of MotW on a file you expect to have been downloaded should be treated as suspicious and investigated further.

### Analyzing the Artifact

#### Reading Zone.Identifier on a Live System

```powershell
# PowerShell - read the ADS contents
Get-Content -Path "C:\Users\user\Downloads\file.exe" -Stream Zone.Identifier

# PowerShell - list all files with Zone.Identifier in a directory
Get-ChildItem -Path "C:\Users\user\Downloads" -Recurse |
    ForEach-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue } |
    Select-Object FileName
```

```cmd
# Command line - using notepad to view the ADS
notepad "C:\Users\user\Downloads\file.exe:Zone.Identifier"

# Using more
more < "C:\Users\user\Downloads\file.exe:Zone.Identifier"
```

#### Forensic Image Analysis

* **MFTECmd (Eric Zimmerman):** Parse the MFT to identify files with alternate data streams, including `Zone.Identifier`. This can reveal downloaded files even in unexpected locations like `C:\Windows\System32` or temp directories.
* **FTK Imager:** View ADS contents directly from a forensic image.
* **The Sleuth Kit (TSK):** Use `fls` to list files with ADS, `istat` to view ADS details for a specific MFT entry, and `icat` to extract the ADS contents.
* **Velociraptor:** The `Windows.NTFS.ADSHunter` artifact can scan for and collect `Zone.Identifier` streams across a system.
* **Windows Sysinternals Streams:** `streams.exe -s C:\Users` recursively lists all files with ADS.

#### What to Look For

During an investigation, focus on:

* Files with ZoneId=3 or ZoneId=4 in sensitive directories (System32, ProgramData, temp folders, user profile root).
* `HostUrl` or `ReferrerUrl` values pointing to suspicious domains, IP addresses, paste sites, file-sharing services, or CDN URLs commonly abused for payload hosting.
* Downloaded executables, scripts (.ps1, .vbs, .js, .hta, .wsf), or Office documents with macros.
* The *absence* of `Zone.Identifier` on files that contextual evidence (browser history, Prefetch, proxy logs) suggests were downloaded. This may indicate a MotW bypass or command-line download tool was used.

### Artifact Correlation

* **Browser History:** Correlate `HostUrl`/`ReferrerUrl` from `Zone.Identifier` with browser download records to build a complete picture of the download chain.
* **Prefetch / Amcache:** Determine if a downloaded executable was subsequently executed.
* **$MFT / $UsnJrnl:** Timeline file creation events alongside `Zone.Identifier` data to establish when files arrived on the system.
* **Email Headers / Attachments:** For files saved from email, correlate with email artifacts to identify the sender and delivery path.
* **Proxy / Firewall Logs:** Match `HostUrl` values against network logs for additional context.

### References

* [MITRE ATT\&CK T1553.005 - Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005/)
* [Red Canary: Mark of the Web Bypass](https://redcanary.com/threat-detection-report/techniques/mark-of-the-web-bypass/)
* [Microsoft: IAttachmentExecute Interface](https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iattachmentexecute)
* [BleepingComputer: 7-Zip MotW bypass exploited in zero-day attacks](https://www.bleepingcomputer.com/news/security/7-zip-motw-bypass-exploited-in-zero-day-attacks-against-ukraine/)