76

I often see files named 'blabla.exe:Zone.Identifier' when monitoring I/O with Process Monitor.
The files are seen on network-drives.

alt text

  • What are Zone.Identifier files?
  • What does the colon mean in the filename?

Is the colon related the file's extended attributes?

mikemaccana
  • 81,787
  • 73
  • 317
  • 396
Benjamin
  • 8,715
  • 14
  • 72
  • 121

1 Answers1

57

The text after the colon is an identifier for an "Alternate Data Stream". ADS is used to store meta-information about the file. For example, the Zone identifier stores whether the file was downloaded from the internet.

Some specific info: About URL Security Zones, Zone.Identifier Stream Name

Best is to google around for more information. Eg. this, this and this.

Finally, here's Streams, the Sysinternals tool for ADS.

Community
  • 1
  • 1
Zabba
  • 60,240
  • 44
  • 170
  • 200
  • 9
    Just the answer I was looking for! But allow me to publicize a good question from another Stack Exchange site: [Why shouldn't we use words such as 'here' and 'this' in textlinks?](http://ux.stackexchange.com/questions/12100) – hippietrail Dec 09 '12 at 03:00
  • FYI, the [Zone.Identifier Stream Name](https://msdn.microsoft.com/en-us/library/dn392609.aspx) MSDN Link has changed. – Sebastian Wagner Jun 26 '15 at 10:34
  • Dead links have been fixed. – mguassa Jan 01 '16 at 19:13
  • 3
    Can I avoid these ADS files as I do not want them? I get them when [copying](https://github.com/microsoft/WSL/issues/4609) from windows to a wsl folder – Timo Nov 24 '20 at 14:27