0. Disable saving the zone identifier - or clear it with a tool. This information is most likely preserved when copying a file, and depending on the tool and fo

0. Disable saving the zone identifier - or clear it with a tool. This information is most likely preserved when copying a file, and depending on the tool and format, it might get into a compressed archive to be restored later. https://www.digital-detective.net/forensic-analysis-of-zone-identifier-stream/ https://www.digital-detective.net/forensic-analysis-of-zone-... There's a Total Commander plugin which can show where a given file was downloaded from. Not sure which one it is as I have multiple installed. Probably this one: https://totalcmd.net/plugring/ntfsstreamviewer.html https://totalcmd.net/plugring/ntfsstreamviewer.html