I often see files named 'blabla.exe:Zone.Identifier' when monitoring I/O with Process Monitor.
The files are seen on network-drives.
Zone.Identifier
files?The text after the colon is an identifier for an "Alternate Data Stream". ADS is used to store meta-information about the file. For example, the Zone identifier stores whether the file was downloaded from the internet.
Some specific info: About URL Security Zones, Zone.Identifier Stream Name
Best is to google around for more information. Eg. this, this and this.
Finally, here's Streams, the Sysinternals tool for ADS.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With