Page 1 of 1
file source URL contained in ZoneIdentifier stream
Posted: Sat Aug 20, 2022 4:37 pm
by jimspoon
I often wished that I could know where I downloaded a certain image from. Little did I know it's there in the ZoneIdentifier stream, as follows:
Code: Select all
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg
HostUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg
It wouldn't be hard to put this in an Everything column.
Re: file source URL contained in ZoneIdentifier stream
Posted: Sat Aug 20, 2022 10:51 pm
by void
I have put on my TODO list to add columns for the ZoneIdentifier alternate data stream.
Thank you for the suggestion.
For now, please try the following search:
regex:adstextplain:HostUrl=(.*) addcolumn:regmatch1
The download URL is shown in the newly added Regular Expression Match 1 column.
Re: file source URL contained in ZoneIdentifier stream
Posted: Wed Aug 31, 2022 5:44 am
by void
Everything 1.5.0.1316a adds the following properties:
Zone ID
Referrer URL
Host URL
Re: file source URL contained in ZoneIdentifier stream
Posted: Fri Sep 30, 2022 10:40 pm
by harryray2
This is good...What's would the search be to show both the Host URL and the Referrer URL?
I tried some combinations, but couldn't get it to work...
Re: file source URL contained in ZoneIdentifier stream
Posted: Fri Sep 30, 2022 11:15 pm
by void
To show the Host URL and referrer URL columns, include the following in your search:
addcolumns:hosturl;referrerurl
-or-
Right click the result list column header and click Add columns.
Select the Host URL and referrer URL properties and click OK.
To search for files that contain both a Host URL and a Referrer URL, include the following in your search:
hosturl: referrerurl:
host-url:
referrer-url:
zone-id:
Re: file source URL contained in ZoneIdentifier stream
Posted: Fri Sep 30, 2022 11:20 pm
by harryray2
Thanks David, is this correct?
"D:\01 downloads\" regex:adstextplain:HostUrl;referrerurl=(.*) addcolumns:hosturl;referrerurl
Re: file source URL contained in ZoneIdentifier stream
Posted: Fri Sep 30, 2022 11:40 pm
by void
The regex part is not needed any more.
Please try the following search:
"D:\01 downloads\" addcolumns:hosturl;referrerurl
If you want to list only files where both the host-url and referrer-url are set, please try the following search:
"D:\01 downloads\" hosturl: referrerurl: addcolumns:hosturl;referrerurl
Re: file source URL contained in ZoneIdentifier stream
Posted: Mon Oct 03, 2022 7:53 pm
by therube
Little did I know it's there in the ZoneIdentifier stream
I'll just point out that not everything generates "zoneidetifiers".
I believe this will be (at least mostly) MS-cetric (including "IE", which I suppose now encompasses Edge).
Re: file source URL contained in ZoneIdentifier stream
Posted: Mon Oct 03, 2022 8:59 pm
by NotNull
To my best of knowledge, with all major internetbrowsers on Windows, Zone.identifier streams are generated.
There is a group policy to disable generating these streams.
Another possibility:
When you download files to a non-NTFS volume (without support for NTFS streams), the Zone.identifier stream can not be written (obviously)