Zone.Identifier Files when copying from Windows to WSL filestructure

[Kai-Richardson]

• Windows build number: Microsoft Windows [Version 10.0.18990.1]

uname -a produces: Linux 4.19.67-microsoft-standard #1 SMP Sun Aug 18 13:37:54 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

• What you're doing and what's happening: This occurs when using Windows Explorer.

1. Download a file from an online resource into a windows folder. For example, this image downloaded into your Downloads folder.
2. Drag/Copy/Move said file into a WSL directory.
3. Notice the file that is also created, named like "movedfile•Zone.Identifier", but instead of a bullet it is the character 0xF03A (Unicode: U+F03A). It does render like a bullet in Windows Explorer though.

• What's wrong / what should be happening instead: The filename•Zone.Identifier NFTS files should not be created.

Contents of the Zone Identifier file are as to be expected, my sample having the contents:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://i.imgur.com/7uEP6ds.png
HostUrl=https://i.imgur.com/7uEP6ds.png

Image:

[therealkenc]

Can't repro here.

This is on 19002; whether the small version bump makes a difference I doubt. Zone.Identifier does get a quick search hit. Said functionality is news to me.

On a lark, from your WSL2 bash prompt, what is the output of:

$ powershell.exe "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct" | grep displayName

[0xbadfca11]

I can reproduce with both WSL1 and WSL2 at 19002.
Zone.Identifier may not exist for various reasons, such as the "Do not save zone information in attachments" policy or deleted by Windows Smart Screen when opening a file.

[Kai-Richardson]

@therealkenc For the output of your powershell grep: displayName : Windows Defender

Also, I've been experiencing this for many versions/months, so it's not something that was introduced as of recent.

[Kai-Richardson]

@0xbadfca11 Regarding your link to the azure windows documentation, I have no Attachments key in HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments. Therefore, if the documentation is correct, If you do not configure this policy setting, Windows marks file attachments with their zone information.

[therealkenc]

If you do not configure this policy setting, Windows marks file attachments with their zone information.

I didn't configure anything "special" in my policy (almost never do as a rule) but copying the file didn't produce the artifact. It does for you and 0xbadfca11.

I suppose the experiment to try is drag a file out of Downloads and onto some Windows share on some other computer on your local network (or a VM). If that Zone.Identifier file also appears in a "normal" network share scenario then this smells by-design-Windows.

I think (?) the variable here might be in your step (1) "Download a file from an online resource into a windows folder". You didn't say how. I used Chrome, but it could have been curl. The fact that file came from https://i.imgur.com/ was long lost to the wind by the time my drag-and-drop happened.

[Kai-Richardson]

@therealkenc Here's the steps I take exactly, using Firefox (reproduced on Chrome):

1. Navigate to an image url.
2. Right click and Save Image As
3. Choose location on my Windows NTFS C: Drive, such as C:\Users\zekai\Desktop
4. Drag (Click and hold) or copy/paste (CTRL+C & CTRL+P) PNG file to a WSL filespace, such as \\wsl$\Ubuntu\home\cassini\github
5. Nothing appears at first, but click the refresh button on explorer.exe in the top right.
6. Notice new Zone.Identifier file.

Here's my output from df -Th, to list filesystem/partition information.

df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/sdb       ext4      251G  9.0G  230G   4% /
tools          9p        477G  303G  174G  64% /init
none           devtmpfs  7.3G     0  7.3G   0% /dev
none           tmpfs     7.3G  8.0K  7.3G   1% /run
none           tmpfs     7.3G     0  7.3G   0% /run/lock
none           tmpfs     7.3G     0  7.3G   0% /run/shm
none           tmpfs     7.3G     0  7.3G   0% /run/user
tmpfs          tmpfs     7.3G     0  7.3G   0% /sys/fs/cgroup
C:\            9p        477G  303G  174G  64% /mnt/c
D:\            9p        932G  531G  402G  57% /mnt/d

[therealkenc]

Notice new Zone.Identifier file.

Thanks for the detailed steps. Caught it; same repro,

Below seems to be a hint. "This file came from another computer and might be blocked to help protect this computer."

Clicking that "unblock" button cures. Which puts this (rather unfortunately) in by-design territory, and worse, out-of-scope WSL territory.

[Kai-Richardson]

@therealkenc

Clicking that "unblock" button cures. Which puts this (rather unfortunately) in by-design territory, and worse, out-of-scope WSL territory.

I would argue that having extraneous files pop into existence every time something downloaded is copied over to the WSL filesystem should be classified as a bug and not by-design.

Since these .Identifiers are quite useless once they get moved WSL, why not simply ignore the NTFS alternate file stream data during the copy process between file systems. This issue definitely has caused me a bit of pain when I download zipped directories and bring them over to WSL, leading to a proliferation of dozens of .Identifier files.

This command (PowerShell) lists all files with an associated Identifier stream in a directory:
Get-ChildItem -Recurse | Get-Item -Stream Zone.Identifier -ErrorAction SilentlyContinue | Select-Object FileName

This is how you remove them with PowerShell:
Remove-Item .\example.exe -Stream Zone.Identifier

If PowerShell has the tools to remove these stream identifiers, why can't WSL remove them upon file copy over?

[therealkenc]

why not simply ignore the NTFS alternate file stream data during the copy process between file systems

Likely because WSL doesn't have the faintest idea whether (scare quote) "those files" should be copied or not. Also because axiom that if the word "simply" is evoked, the premise is near always incorrect.

I would argue that having extraneous files pop into existence every time something downloaded is copied over to the WSL filesystem should be classified as a bug and not by-design.

Me too; although someone on the some team somewhere at MSFT thought "This file came from another computer and might be blocked" was a good idea.

This all said, I did the experiment of copying the untrused (?) file onto a local share, and there isn't any "•Zone.Identifier" shenanigans.

This issues hasn't been closed by-design. Someone over my pay grade would need to do that. If it were, you'd already know.

[riverar]

Explorer is attempting to set the NTFS ADS and WSL is not handling this correctly. The 0x003A (colon) getting altered to 0xF03A (dot) sounds like text encoding or path sanitation gone awry.

If this magic WSL$ share isn't going to support storing ADS, then it needs to drop the ADS requests altogether. Dumping files in the share is terrible UX, could affect disk space (Zone Identifiers are not the only items stored in ADS), and is useless busywork as neither Windows or Linux support this ·Zone.Identifier loose file.

Stack from a CreateFile on \\wsl$\Ubuntu\tmp\my.png:Zone.Identifier, Windows 10 18363.418:

1	FLTMGR.SYS	FltpPassThroughInternal + 0x90	0xfffff802213e35a0	C:\WINDOWS\System32\drivers\FLTMGR.SYS
2	FLTMGR.SYS	FltpCreate + 0x2f3	0xfffff8022141bd13	C:\WINDOWS\System32\drivers\FLTMGR.SYS
3	ntoskrnl.exe	IofCallDriver + 0x59	0xfffff80223831f39	C:\WINDOWS\system32\ntoskrnl.exe
4	ntoskrnl.exe	IoCallDriverWithTracing + 0x34	0xfffff80223830fe4	C:\WINDOWS\system32\ntoskrnl.exe
5	ntoskrnl.exe	IopParseDevice + 0x62b	0xfffff80223de5ffb	C:\WINDOWS\system32\ntoskrnl.exe
6	ntoskrnl.exe	IopParseFile + 0xc7	0xfffff80223ebccc7	C:\WINDOWS\system32\ntoskrnl.exe
7	ntoskrnl.exe	ObpLookupObjectName + 0x78f	0xfffff80223decfcf	C:\WINDOWS\system32\ntoskrnl.exe
8	ntoskrnl.exe	ObOpenObjectByNameEx + 0x201	0xfffff80223deb431	C:\WINDOWS\system32\ntoskrnl.exe
9	ntoskrnl.exe	IopCreateFile + 0x820	0xfffff80223e30300	C:\WINDOWS\system32\ntoskrnl.exe
10	ntoskrnl.exe	IoCreateFileEx + 0x11d	0xfffff80223e2f9ad	C:\WINDOWS\system32\ntoskrnl.exe
11	LXCORE.SYS	LxpUtilOpenFileEx + 0x356	0xfffff80226752d6a	C:\WINDOWS\system32\drivers\LXCORE.SYS
12	LXCORE.SYS	LxpUtilOpenFile + 0x45	0xfffff80226752a09	C:\WINDOWS\system32\drivers\LXCORE.SYS
13	LXCORE.SYS	LxVolFsInodeOpen + 0xa0	0xfffff802267739e0	C:\WINDOWS\system32\drivers\LXCORE.SYS
14	LXCORE.SYS	VfsInodeOpen + 0x176	0xfffff8022675f9ae	C:\WINDOWS\system32\drivers\LXCORE.SYS
15	LXCORE.SYS	VfsOpenInodeEx + 0x1bc	0xfffff8022676493c	C:\WINDOWS\system32\drivers\LXCORE.SYS
16	LXCORE.SYS	VfsOpenFile + 0xa3	0xfffff80226764723	C:\WINDOWS\system32\drivers\LXCORE.SYS
17	LXCORE.SYS	LxpUtilOpenUserPathAt + 0xab	0xfffff80226752ec3	C:\WINDOWS\system32\drivers\LXCORE.SYS
18	LXCORE.SYS	LxpOpenHelper + 0x90	0xfffff80226738528	C:\WINDOWS\system32\drivers\LXCORE.SYS
19	LXCORE.SYS	LxpSyscall_OPENAT + 0x9	0xfffff8022673faa9	C:\WINDOWS\system32\drivers\LXCORE.SYS
20	LXCORE.SYS	LxpSysDispatch + 0x114	0xfffff80226739944	C:\WINDOWS\system32\drivers\LXCORE.SYS
21	LXCORE.SYS	PicoSystemCallDispatch + 0x11	0xfffff80226756df1	C:\WINDOWS\system32\drivers\LXCORE.SYS
22	ntoskrnl.exe	PsPicoSystemCallDispatch + 0x1f	0xfffff802240cbb5f	C:\WINDOWS\system32\ntoskrnl.exe
23	ntoskrnl.exe	KiSystemServiceUser + 0x76	0xfffff802239d28f8	C:\WINDOWS\system32\ntoskrnl.exe

[chiefjester]

@therealkenc I've been getting this for months too, and I think I know why you are not getting any Zone Identifier file. If I copy and paste to a WSL2 folder, I won't see the identifier file yet. But if I go a folder up, then go back again to the original folder, I now see the identifier file.

here's the video of what I'm seeing.

I also want to add that I copied from a Downloads folder of Windows to a folder of my \\wsl$\ubuntu...\home\username\.local\_temp

I'm using WSL2, and here's my build number.
Microsoft Windows [Version 10.0.19037.1]

[Stanzilla]

Yeah this is happening here as well, pretty annoying.

[ThaDaVos]

I hope this gets fixed soon as it's really annoying when, like mentioned already, you copy a extracted zip file to the WSL directory

[chiefjester]

@therealkenc hey there, 👋🏻. I was wondering if you are now seeing this a bug after I posted details on how to reproduce it to give you more context?

If you can reproduce it, any chance we can label this as a bug?