What are `Zone.Identifier` files, and how do I prevent them from being created? [closed]

News

I often see files named 'blabla.exe:Zone.Identifier' when monitoring I/O with Process Monitor.
The files are seen on network-drives.

alt text

  • What are Zone.Identifier files?
  • What does the colon mean in the filename?
  • Is the colon related the file's extended attributes?
  • How do I prevent these files from being created when I copy code files from Windows Explorer to a WSL directory?
2

1 Answer

The text after the colon is an identifier for an "Alternate Data Stream". ADS is used to store meta-information about the file. For example, the Zone identifier stores whether the file was downloaded from the internet.

Some specific info about URL Security Zones, Zone.Identifier Stream Name

See also Technet, Heysoft and this article about alternative data streams.

Finally, here's Streams, the Sysinternals tool for ADS.

4

ncG1vNJzZmirpJawrLvVnqmfpJ%2Bse6S7zGiorp2jqbawutJoa21xZmuGeHvWoZitZZGnsm7GzqecZqGUmru1tcWinKtllp65pr%2BMmqWdZZikxG6wzmagZqiimsOmutNmq6GdnWKzs7vMZpmeoZ6ceqS%2BxJqrnpw%3D