Off-topic posts of interest to the "Everything" community.
jimspoon
Posts: 185 Joined: Tue Apr 26, 2011 11:39 pm
Post
by jimspoon » Sat Aug 20, 2022 4:37 pm
I often wished that I could know where I downloaded a certain image from. Little did I know it's there in the ZoneIdentifier stream, as follows:
Code: Select all
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg
HostUrl=https://tile.loc.gov/storage-services/service/pnp/pan/6a28000/6a28800/6a28800r.jpg
It wouldn't be hard to put this in an Everything column.
void
Developer
Posts: 16632 Joined: Fri Oct 16, 2009 11:31 pm
Post
by void » Sat Aug 20, 2022 10:51 pm
I have put on my TODO list to add columns for the ZoneIdentifier alternate data stream.
Thank you for the suggestion.
For now, please try the following search:
regex:adstextplain:HostUrl=(.*) addcolumn:regmatch1
The download URL is shown in the newly added Regular Expression Match 1 column.
harryray2
Posts: 1103 Joined: Sat Oct 15, 2016 9:56 am
Post
by harryray2 » Fri Sep 30, 2022 10:40 pm
This is good...What's would the search be to show both the Host URL and the Referrer URL?
I tried some combinations, but couldn't get it to work...
void
Developer
Posts: 16632 Joined: Fri Oct 16, 2009 11:31 pm
Post
by void » Fri Sep 30, 2022 11:15 pm
To show the Host URL and referrer URL columns, include the following in your search:
addcolumns:hosturl;referrerurl
-or-
Right click the result list column header and click Add columns.
Select the Host URL and referrer URL properties and click OK.
To search for files that contain both a Host URL and a Referrer URL, include the following in your search:
hosturl: referrerurl:
host-url:
referrer-url:
zone-id:
harryray2
Posts: 1103 Joined: Sat Oct 15, 2016 9:56 am
Post
by harryray2 » Fri Sep 30, 2022 11:20 pm
Thanks David, is this correct?
"D:\01 downloads\" regex:adstextplain:HostUrl;referrerurl=(.*) addcolumns:hosturl;referrerurl
void
Developer
Posts: 16632 Joined: Fri Oct 16, 2009 11:31 pm
Post
by void » Fri Sep 30, 2022 11:40 pm
The regex part is not needed any more.
Please try the following search:
"D:\01 downloads\" addcolumns:hosturl;referrerurl
If you want to list only files where both the host-url and referrer-url are set, please try the following search:
"D:\01 downloads\" hosturl: referrerurl: addcolumns:hosturl;referrerurl
therube
Posts: 4947 Joined: Thu Sep 03, 2009 6:48 pm
Post
by therube » Mon Oct 03, 2022 7:53 pm
Little did I know it's there in the ZoneIdentifier stream
I'll just point out that not everything generates "zoneidetifiers".
I believe this will be (at least mostly) MS-cetric (including "IE", which I suppose now encompasses Edge).
NotNull
Posts: 5456 Joined: Wed May 24, 2017 9:22 pm
Post
by NotNull » Mon Oct 03, 2022 8:59 pm
To my best of knowledge, with all major internetbrowsers on Windows, Zone.identifier streams are generated.
There is a group policy to disable generating these streams.
Another possibility:
When you download files to a non-NTFS volume (without support for NTFS streams), the Zone.identifier stream can not be written (obviously)