In a Windows 10 guest under VirtualBox in Ubuntu 17.10 I downloaded a PDF file and got two files:

<filename>.pdf                         # as expected
<filename>.pdf:Zone.Identifier:$DATA   # ??

The second file has a size of 26B and has the following contents:


What is this second file and why do I get it? Is it perhaps related to the SharedFolder of Virtualbox?


Windows NTFS has a feature called Alternate Data Streams whereby additional file data can be stored alongside the main file data. When you download a file Windows uses an alternate stream to store file metadata indicating whether the file was downloaded from the internet.

From Microsoft Sysinternals

The NTFS file system provides applications the ability to create alternate data streams of information. By default, all data is stored in a file's main unnamed data stream, but by using the syntax 'file:stream', you are able to read and write to alternates

It would appear that your shared folder impersonates an NTFS disk (or your browser simply doesn't care if it isn't) and Windows continues to attempt to create the alternate data stream for downloaded files.

The file is largely unimportant and can be deleted if you do not wish to get a warning when you run the file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.