Find out where a file was downloaded from

In Mac OS X, there is a very useful file property called "Where from" which tells you the URL that the file was downloaded from, available via the "Get Info" context menu within the "More Info" section, as seen below:

My question is this: Can this information be accessed in Windows?

I've never seen that kind of information displayed anywhere before so I would assume the answer to be no and put it down to either a limitation of Windows or its file systems BUT every now and again I open a file and get the following warning:

So, Windows is obviously aware that the file has been downloaded from the Internet somehow - whether that be simply via a fileDownloadedFromInternet: true flag or something I don't know but it's enough for me to ask.

2 Answers

Your computer is able to tell that the file was downloaded from the Internet using ADS, or Alternate Data Streams, a feature of the NTFS file system. Being an NTFS feature, if the item in question is transferred to another file system, such as FAT on a USB, the ADS will be lost. In the case of files downloaded from the internet, an ADS extension is added on to the file that identifies that file from coming from a "zone" of Internet - where a zone is defined (in Internet Explorer, at least) in Internet Options -> Security. Different zones mean the files come from different places (see here).

To see where an ADS is located, you use the Dir /R command, which has an output similar to this:

 Directory of C:\Users\Jacob\Downloads
12/31/2013 09:19 PM <DIR> .
12/31/2013 09:19 PM <DIR> ..
12/31/2013 09:19 PM 0 ads.txt
12/31/2013 09:03 PM 502,784 kitty_portable.exe 26 kitty_portable.exe:Zone.Identifier:$DATA
12/31/2013 09:09 PM <DIR> others 2 File(s) 502,784 bytes 3 Dir(s) 41,975,984,128 bytes free

According to the link above, the contents of the ADS stream go something like this for a file downloaded from the Internet, where the zone is the one specified by your browser. You can view what is in the ADS by running notepad kitty_portable.exe:Zone.Identifier, in my case:

[ZoneTransfer]
ZoneId=3

As seen on this site there are six Zone Transfer IDs, with 3 being Internet Zone as seen above.

Now, when you try to open a file that has that ZoneID set, you are met with an annoying prompt like the one you mentioned. There is a way to remove it, however, by right-clicking on the file, going to Properties, and clicking "Unblock" at the bottom:

What this does is removes the ADS that is appended to the file, which no longer makes your computer worry about opening it. This removal of the ADS can be verified by doing Dir /R in the same directory. You will see that the ADS is now gone:

 Directory of C:\Users\Jacob\Downloads
12/31/2013 10:32 PM <DIR> .
12/31/2013 10:32 PM <DIR> ..
12/31/2013 10:31 PM 502,784 kitty_portable.exe
12/31/2013 10:32 PM 0 output.txt 2 File(s) 502,784 bytes 2 Dir(s) 41,850,904,576 bytes free

All gone! Basically, as soon as you clear out the downloads in Internet Explorer (or another browser), Windows has no idea what website the file came from, just that it came from the Internet. If the file had a location associated with it, it would most likely have been saved in the ADS.

Viewing Zone.Identifier content in the command prompt

+1 for the accepted answer, but I wanted to view this from a CMD prompt directly.

Assuming you have a downloaded file in the current directory named example.pdf, and assuming your browser stored this info in the Zone.Identifier ADS associated with it, run this command:

more < example.pdf:Zone.Identifier

Example output:

[ZoneTransfer]
ZoneId=3
HostUrl=