file source URL contained in ZoneIdentifier stream

Off-topic posts of interest to the "Everything" community.
Post Reply
jimspoon
Posts: 152
Joined: Tue Apr 26, 2011 11:39 pm

file source URL contained in ZoneIdentifier stream

Post by jimspoon »

I often wished that I could know where I downloaded a certain image from. Little did I know it's there in the ZoneIdentifier stream, as follows:

Code: Select all

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg
HostUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg
It wouldn't be hard to put this in an Everything column.
void
Developer
Posts: 15098
Joined: Fri Oct 16, 2009 11:31 pm

Re: file source URL contained in ZoneIdentifier stream

Post by void »

I have put on my TODO list to add columns for the ZoneIdentifier alternate data stream.
Thank you for the suggestion.

For now, please try the following search:
regex:adstextplain:HostUrl=(.*) addcolumn:regmatch1

The download URL is shown in the newly added Regular Expression Match 1 column.
void
Developer
Posts: 15098
Joined: Fri Oct 16, 2009 11:31 pm

Re: file source URL contained in ZoneIdentifier stream

Post by void »

Everything 1.5.0.1316a adds the following properties:

Zone ID
Referrer URL
Host URL
harryray2
Posts: 1049
Joined: Sat Oct 15, 2016 9:56 am

Re: file source URL contained in ZoneIdentifier stream

Post by harryray2 »

This is good...What's would the search be to show both the Host URL and the Referrer URL?
I tried some combinations, but couldn't get it to work...
void
Developer
Posts: 15098
Joined: Fri Oct 16, 2009 11:31 pm

Re: file source URL contained in ZoneIdentifier stream

Post by void »

To show the Host URL and referrer URL columns, include the following in your search:

addcolumns:hosturl;referrerurl

-or-

Right click the result list column header and click Add columns.
Select the Host URL and referrer URL properties and click OK.



To search for files that contain both a Host URL and a Referrer URL, include the following in your search:

hosturl: referrerurl:



host-url:
referrer-url:
zone-id:
harryray2
Posts: 1049
Joined: Sat Oct 15, 2016 9:56 am

Re: file source URL contained in ZoneIdentifier stream

Post by harryray2 »

Thanks David, is this correct?

"D:\01 downloads\" regex:adstextplain:HostUrl;referrerurl=(.*) addcolumns:hosturl;referrerurl
void
Developer
Posts: 15098
Joined: Fri Oct 16, 2009 11:31 pm

Re: file source URL contained in ZoneIdentifier stream

Post by void »

The regex part is not needed any more.


Please try the following search:

"D:\01 downloads\" addcolumns:hosturl;referrerurl



If you want to list only files where both the host-url and referrer-url are set, please try the following search:

"D:\01 downloads\" hosturl: referrerurl: addcolumns:hosturl;referrerurl
therube
Posts: 4580
Joined: Thu Sep 03, 2009 6:48 pm

Re: file source URL contained in ZoneIdentifier stream

Post by therube »

Little did I know it's there in the ZoneIdentifier stream
I'll just point out that not everything generates "zoneidetifiers".
I believe this will be (at least mostly) MS-cetric (including "IE", which I suppose now encompasses Edge).
NotNull
Posts: 5167
Joined: Wed May 24, 2017 9:22 pm

Re: file source URL contained in ZoneIdentifier stream

Post by NotNull »

To my best of knowledge, with all major internetbrowsers on Windows, Zone.identifier streams are generated.

There is a group policy to disable generating these streams.
Another possibility:
When you download files to a non-NTFS volume (without support for NTFS streams), the Zone.identifier stream can not be written (obviously)
Post Reply