Find out where a file was downloaded from

Solution 1:

Your computer is able to tell that the file was downloaded from the Internet using ADS, or Alternate Data Streams, a feature of the NTFS file system. Being an NTFS feature, if the item in question is transferred to another file system, such as FAT on a USB, the ADS will be lost. In the case of files downloaded from the internet, an ADS extension is added on to the file that identifies that file from coming from a "zone" of Internet - where a zone is defined (in Internet Explorer, at least) in Internet Options -> Security. Different zones mean the files come from different places (see here).

To see where an ADS is located, you use the Dir /R command, which has an output similar to this:

 Directory of C:\Users\Jacob\Downloads

12/31/2013  09:19 PM    <DIR>          .
12/31/2013  09:19 PM    <DIR>          ..
12/31/2013  09:19 PM                 0 ads.txt
12/31/2013  09:03 PM           502,784 kitty_portable.exe
                                    26 kitty_portable.exe:Zone.Identifier:$DATA
12/31/2013  09:09 PM    <DIR>          others
               2 File(s)        502,784 bytes
               3 Dir(s)  41,975,984,128 bytes free

According to the link above, the contents of the ADS stream go something like this for a file downloaded from the Internet, where the zone is the one specified by your browser. You can view what is in the ADS by running notepad kitty_portable.exe:Zone.Identifier, in my case:

[ZoneTransfer]
ZoneId=3

As seen on this site there are six Zone Transfer IDs, with 3 being Internet Zone as seen above.

Now, when you try to open a file that has that ZoneID set, you are met with an annoying prompt like the one you mentioned. There is a way to remove it, however, by right-clicking on the file, going to Properties, and clicking "Unblock" at the bottom:

What this does is removes the ADS that is appended to the file, which no longer makes your computer worry about opening it. This removal of the ADS can be verified by doing Dir /R in the same directory. You will see that the ADS is now gone:

 Directory of C:\Users\Jacob\Downloads

12/31/2013  10:32 PM    <DIR>          .
12/31/2013  10:32 PM    <DIR>          ..
12/31/2013  10:31 PM           502,784 kitty_portable.exe
12/31/2013  10:32 PM                 0 output.txt
               2 File(s)        502,784 bytes
               2 Dir(s)  41,850,904,576 bytes free

All gone! Basically, as soon as you clear out the downloads in Internet Explorer (or another browser), Windows has no idea what website the file came from, just that it came from the Internet. If the file had a location associated with it, it would most likely have been saved in the ADS.