01Location
- <file>:Zone.Identifier (named $DATA attribute on NTFS)
02Questions it answers
- Did a file arrive from the Internet or a restricted zone (browser download, e-mail attachment)?
- Which zone was recorded for the file?
- Was the mark removed, and when was the stream added or removed?
03Format and versions
| Format | INI-style text stream with a [ZoneTransfer] section and ZoneId=<n>, where n is a URLZONE value: 0 local machine, 1 local intranet, 2 trusted sites, 3 Internet, 4 restricted sites. |
|---|---|
| Applies to | Files on NTFS; Mark of the Web does not apply to files saved on FAT32. |
04Key fields
| Field | What it tells you |
|---|---|
| [ZoneTransfer] | Section header of the stream. |
| ZoneId | URLZONE number of the source zone. |
| Stream presence in $MFT | Named $DATA attribute 'Zone.Identifier' on the file's MFT entry. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| $UsnJrnl record for the stream | FILETIME (UTC) | A named stream being added or removed is logged with USN_REASON_STREAM_CHANGE; writes use NAMED_DATA_* flags. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Enumerate named data streams from $MFT rather than relying on directory listings.
- Read each Zone.Identifier stream and map ZoneId to its URLZONE meaning.
- Search $UsnJrnl for STREAM_CHANGE records to time when marks were added or removed.
- Correlate with browser download history, e-mail artifacts and LNK files.
07Interpretation pitfalls
- By default the mark is added only for the Internet and Restricted sites zones, so its absence does not prove local origin.
- Users can remove the mark (Properties > Unblock, or Unblock-File), and files synced by the OneDrive client or opened via 'Open in Desktop App' do not receive it.
- The mark only exists on NTFS; files stored on FAT32 do not carry it.
09Sources
- Macros from the internet are blocked by default in Office Microsoft Learn · checked 2026-10-14
- URLZONE enumeration Microsoft Learn · checked 2026-10-14
- New Technologies File System (NTFS) libyal / libfsntfs (J. Metz) · checked 2026-10-14
- USN_RECORD_V2 structure (winioctl.h) Microsoft Learn · checked 2026-10-14