2 ms·

Let me ground you a bit. This feature is 20 years old. The data is stored in NTFS alternate data streams. https://en.wikipedia.org/wiki/Mark_of_the_Web https:

by nom 11mo ago

Let me ground you a bit. This feature is 20 years old. The data is stored in NTFS alternate data streams. https://en.wikipedia.org/wiki/Mark_of_the_Web https://en.wikipedia.org/wiki/Mark_of_the_Web

phito 11mo ago
Interesting, thanks
childintime 11mo ago
Wow, it contains forensic info: "As of Windows 10, the contents [...] include the keys HostIpAddress, HostUrl, and ReferrerUrl.[...] they typically contain the domain name and exact URL of the original online download location".