Find out where a file was downloaded from

Question

In Mac OS X, there is a very useful file property called "Where from" which tells you the URL that the file was downloaded from, available via the "Get Info" context menu within the "More Info" section, as seen below:

My question is this: Can this information be accessed in Windows?

I've never seen that kind of information displayed anywhere before so I would assume the answer to be no and put it down to either a limitation of Windows or its file systems BUT every now and again I open a file and get the following warning:

So, Windows is obviously aware that the file has been downloaded from the Internet somehow - whether that be simply via a fileDownloadedFromInternet: true flag or something I don't know but it's enough for me to ask.

Answer 1

Your computer is able to tell that the file was downloaded from the Internet using ADS, or Alternate Data Streams, a feature of the NTFS file system. Being an NTFS feature, if the item in question is transferred to another file system, such as FAT on a USB, the ADS will be lost. In the case of files downloaded from the internet, an ADS extension is added on to the file that identifies that file from coming from a "zone" of Internet - where a zone is defined (in Internet Explorer, at least) in Internet Options -> Security. Different zones mean the files come from different places (see here).

To see where an ADS is located, you use the Dir /R command, which has an output similar to this:

 Directory of C:\Users\Jacob\Downloads

12/31/2013  09:19 PM    <DIR>          .
12/31/2013  09:19 PM    <DIR>          ..
12/31/2013  09:19 PM                 0 ads.txt
12/31/2013  09:03 PM           502,784 kitty_portable.exe
                                    26 kitty_portable.exe:Zone.Identifier:$DATA
12/31/2013  09:09 PM    <DIR>          others
               2 File(s)        502,784 bytes
               3 Dir(s)  41,975,984,128 bytes free

According to the link above, the contents of the ADS stream go something like this for a file downloaded from the Internet, where the zone is the one specified by your browser. You can view what is in the ADS by running notepad kitty_portable.exe:Zone.Identifier, in my case:

[ZoneTransfer]
ZoneId=3

As seen on this site there are six Zone Transfer IDs, with 3 being Internet Zone as seen above.

Now, when you try to open a file that has that ZoneID set, you are met with an annoying prompt like the one you mentioned. There is a way to remove it, however, by right-clicking on the file, going to Properties, and clicking "Unblock" at the bottom:

What this does is removes the ADS that is appended to the file, which no longer makes your computer worry about opening it. This removal of the ADS can be verified by doing Dir /R in the same directory. You will see that the ADS is now gone:

 Directory of C:\Users\Jacob\Downloads

12/31/2013  10:32 PM    <DIR>          .
12/31/2013  10:32 PM    <DIR>          ..
12/31/2013  10:31 PM           502,784 kitty_portable.exe
12/31/2013  10:32 PM                 0 output.txt
               2 File(s)        502,784 bytes
               2 Dir(s)  41,850,904,576 bytes free

All gone! Basically, as soon as you clear out the downloads in Internet Explorer (or another browser), Windows has no idea what website the file came from, just that it came from the Internet. If the file had a location associated with it, it would most likely have been saved in the ADS.