In a file's properties dialog you know that message This file came from another computer and may be blocked...

I want a Windows 7 search query to find files that came from other computers, and files that came from this one. For instance looking for a code snippet javascript onclick type:.js date: earlier this year <file made by me>. Unless I somehow exclude the various program files that match the query, I get too many irrelevant result.

I can't search for author: because it's not a good proxy (files either don't have that metadata or my author name isn't constant over the years).


You can use PowerShell for this. Files originating from the Internet have an alternate data stream called Zone.Identifier. As of PowerShell 3.0, Get-Item supports the -Stream parameter, which allows viewing of ADS. If you're running Windows 8, you should already have a capable version of PowerShell built-in. If you're on Windows 7, you'll need to download an update from Microsoft's website. The latest version is currently PowerShell 4.0.

Once you've got a capable version of PowerShell installed, the following command will list all files in the current folder (and subfolders) which have the Zone.Identifier ADS:

Get-ChildItem -Recurse | Get-Item -Stream Zone.Identifier -ErrorAction SilentlyContinue | Select-Object FileName

Expanded, with comments:

# Get all items in the current folder and its subfolders.
Get-ChildItem -Recurse|

# Get the Zone.Identifier ADS for each item. Suppress error output.
# Errors are suppressed here because otherwise the screen will fill with non-critical errors for all the files that *don't* have the Zone.Identifier ADS - i.e.: Files that aren't from the Internet.
Get-Item -Stream Zone.Identifier -ErrorAction SilentlyContinue |

# Display only the FileName property of each object returned.
Select-Object FileName

"Golfed" version:

ls -Rec|gi -S Zone.Identifier -ErrorA SilentlyContinue|select FileName
  • ls, gi, and select are built-in aliases for Get-ChildItem, Get-Item, and Select-Object, respectively.
  • -Recurse, -Stream, and -ErrorAction were truncated to the minimum length required to uniquely identify the parameter names.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.