With Zone Identifier, we can say whether a file downloaded from internet or not.
A file with zone.identifier extension is an ADS (Alternate Data Stream) file that contains information about another file. It describes the security zone for the file. Zone identifier files are generated by Internet Explorer and Outlook when saving files to a Windows operating system. These files are normally hidden and cannot be opened directly.
Via powershell, we can find Zone Identifiers of a file;
PS C:\Progs\Forensics> Get-Content -Path C:\Progs\Forensics\autopsy-4.17.0-64bit.msi -Stream zone.identifier
PS C:\Progs\Forensics> Get-Item -Path C:\Progs\Forensics\autopsy-4.17.0-64bit.msi -Stream *
How To Remove Zone Identifier
For several reasons, you may choose to delete zone.identifiers. It is very easy to do it. Just right click the file and click “Unblock” tick in “Properties > General” menu.
If you want to remove multiple files, it is still easy. Just navigate to folder including files you want to remove with Powershell and type;
dir .* | Unblock-File
This will clear zone identifier from this folder.