Find 'blocked' download files? (ADS 'Zone.Identifier')

giulia · Post by *giulia » 2016-02-06, 16:57 UTC

Hi
may i ask you if total commander can find blocked files ?

like these
Image: http://thewindowsclub.thewindowsclubco.netdna-cdn.com/wp-content/uploads/2012/08/unblock.jpg

thanks

Vochomurka · Post by *Vochomurka » 2016-02-06, 17:41 UTC

I'm not really sure what is a blocked file, but file locked by an application can be found using this plugin

giulia · Post by *giulia » 2016-02-06, 17:50 UTC

Vochomurka wrote:I'm not really sure what is a blocked file, but file locked by an application can be found using this plugin

hi
i added a screenshot to show you what i mean blocked

Vochomurka · Post by *Vochomurka » 2016-02-06, 17:53 UTC

Yes, I've seen it. I've opened some file peoperties, and I've not found such button anywhere.
So, I guess the stuff I've pointed at is not that you are looking for

Dalai · Post by *Dalai » 2016-02-06, 18:49 UTC

The information about whether a file is "blocked" is saved in NTFS Alternate Data Streams (ADS). To be honest, this "blocked" term is nonsense in my point of view. The ADS really only tells the system that "this file was downloaded from a source that doesn't state if the file is safe, i.e. the internet".

You can use any tool to remove such ADS (or this specific ADS) from the file. There are some TC plugins related to ADS but currently I don't know if any of them can remove/delete ADS.

Regards
Dalai

giulia · Post by *giulia » 2016-02-06, 19:16 UTC

Dalai wrote:The information about whether a file is "blocked" is saved in NTFS Alternate Data Streams (ADS). To be honest, this "blocked" term is nonsense in my point of view. The ADS really only tells the system that "this file was downloaded from a source that doesn't state if the file is safe, i.e. the internet".

You can use any tool to remove such ADS (or this specific ADS) from the file. There are some TC plugins related to ADS but currently I don't know if any of them can remove/delete ADS.

Regards
Dalai

Hi Delai
and find all of them , is there a way?
thanks

Dalai · Post by *Dalai » 2016-02-06, 19:35 UTC

giulia wrote:and find all of them , is there a way?

Sure. You can either use some external tool like NirSoft AlternateStreamView or a TC plugin like NTFS Streams (32 bit only) or NTFS FileStreams.wdx (32 and 64 bit) or a similar plugin on totalcmd.net or some other site (there are quite a few).

The stream you're looking for is named "Zone.Identifier", as can be seen on AlternateStreamView's screenshot.

Regards
Dalai

giulia · Post by *giulia » 2016-02-07, 06:29 UTC

Dalai wrote:
giulia wrote:and find all of them , is there a way?
Sure. You can either use some external tool like NirSoft AlternateStreamView or a TC plugin like NTFS Streams (32 bit only) or NTFS FileStreams.wdx (32 and 64 bit) or a similar plugin on totalcmd.net or some other site (there are quite a few).

The stream you're looking for is named "Zone.Identifier", as can be seen on AlternateStreamView's screenshot.

Regards
Dalai

Hi Delai
i think it doesn't do what i'm looking for
i download NirSoft AlternateStreamView and it marks Zone.Identifier the files are not blocked

ZoSTeR · Post by *ZoSTeR » 2016-02-07, 10:05 UTC

"Zone.Identifier" is just the name of the stream. Whether or not a file is blocked depends on its content.

Blocked files have this identifier:

Code: Select all

[ZoneTransfer]
ZoneId=3

After you unblock them the stream contains:

Code: Select all

[ZoneTransfer]
AppZoneId=4

This article explains it pretty well: How Microsoft SmartScreen works