.identifier file extension

.identifier

Zone identifier ADS.

When a file is downloaded from the internet using Internet Explorer, an additional Alternate Data Stream (ADS) may be created named using the convention:

downloaded-filename:Zone.Identifier

Where "downloaded-filename" is the name of a downloaded file. This is an alternative data stream file and contains security information which can be used to determine the publisher of the file.

Because it is an alternate data stream it is not normally visible. Its presence can be seen using some tools (such as Microsoft's Process Monitor, or some rootkit identification programs). It is only created on NTFS volumes, and only on Windows systems starting with XP SP2.

The contents of the zone identifier ADS can be viewed by at the command prompt using:

more < downloaded-filename:Zone.Identifier

Substituting the real filename (and path) for "downloaded-filename" in the above.

For more information see:

• www.sandersonforensics.com/Files/ZoneIdentifier.pdf - Information about zone identifier files and their contents.

Can you add to this? Do you know of any applications not already listed which will work with .identifier files, view .identifier files or open .identifier files? Are you able to contribute any additional reference information or file format information about .identifier files or have you spotted any errors or omissions? If so please let us know by emailing us at feedback@cryer.co.uk - Thank you.