file source URL contained in ZoneIdentifier stream

[jimspoon]

I often wished that I could know where I downloaded a certain image from. Little did I know it's there in the ZoneIdentifier stream, as follows:

Code: Select all

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg
HostUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg

It wouldn't be hard to put this in an Everything column.

[void]

I have put on my TODO list to add columns for the ZoneIdentifier alternate data stream.
Thank you for the suggestion.

For now, please try the following search:
regex:adstextplain:HostUrl=(.*) addcolumn:regmatch1

The download URL is shown in the newly added Regular Expression Match 1 column.

[void]

Everything 1.5.0.1316a adds the following properties:

Zone ID
Referrer URL
Host URL

[harryray2]

This is good...What's would the search be to show both the Host URL and the Referrer URL?
I tried some combinations, but couldn't get it to work...

[void]

To show the Host URL and referrer URL columns, include the following in your search:

addcolumns:hosturl;referrerurl

-or-

Right click the result list column header and click Add columns.
Select the Host URL and referrer URL properties and click OK.



To search for files that contain both a Host URL and a Referrer URL, include the following in your search:

hosturl: referrerurl:



host-url:
referrer-url:
zone-id:

[harryray2]

Thanks David, is this correct?

"D:\01 downloads\" regex:adstextplain:HostUrl;referrerurl=(.*) addcolumns:hosturl;referrerurl

[void]

The regex part is not needed any more.


Please try the following search:

"D:\01 downloads\" addcolumns:hosturl;referrerurl



If you want to list only files where both the host-url and referrer-url are set, please try the following search:

"D:\01 downloads\" hosturl: referrerurl: addcolumns:hosturl;referrerurl

[therube]

Little did I know it's there in the ZoneIdentifier stream

I'll just point out that not everything generates "zoneidetifiers".
I believe this will be (at least mostly) MS-cetric (including "IE", which I suppose now encompasses Edge).

[NotNull]

To my best of knowledge, with all major internetbrowsers on Windows, Zone.identifier streams are generated.

There is a group policy to disable generating these streams.
Another possibility:
When you download files to a non-NTFS volume (without support for NTFS streams), the Zone.identifier stream can not be written (obviously)