How does Windows know if a file was downloaded from the Internet?

Question

If I open a file in Windows, that was downloaded by chrome or another browser Windows popups a warning, that this file is downloaded from the internet. The same for documents you open in Microsoft Word.

But how does windows know that this file originate from the Internet? I think it's the same file as every other file on my hard drive. Has it to do something with the file properties?

Answer 1

Harry Johnston got it! Had nothing to do with temporary folder or media cache. It's a NTFS Stream. For further reading: MSDN File Streams

This blocking information is archieved with the following commands on the CLI:

(echo [ZoneTransfer]
More? echo ZoneId=3) > test.docx:Zone.Identifier

This creates an alternative file stream.