Zone.Identifier Files when copying from Windows to WSL filestructure

[Kai-Richardson]

• Windows build number: Microsoft Windows [Version 10.0.18990.1]

uname -a produces: Linux 4.19.67-microsoft-standard #1 SMP Sun Aug 18 13:37:54 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

• What you're doing and what's happening: This occurs when using Windows Explorer.

1. Download a file from an online resource into a windows folder. For example, this image downloaded into your Downloads folder.
2. Drag/Copy/Move said file into a WSL directory.
3. Notice the file that is also created, named like "movedfile•Zone.Identifier", but instead of a bullet it is the character 0xF03A (Unicode: U+F03A). It does render like a bullet in Windows Explorer though.

• What's wrong / what should be happening instead: The filename•Zone.Identifier NFTS files should not be created.

Contents of the Zone Identifier file are as to be expected, my sample having the contents:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://i.imgur.com/7uEP6ds.png
HostUrl=https://i.imgur.com/7uEP6ds.png

Image:

[therealkenc]

Can't repro here.

This is on 19002; whether the small version bump makes a difference I doubt. Zone.Identifier does get a quick search hit. Said functionality is news to me.

On a lark, from your WSL2 bash prompt, what is the output of:

$ powershell.exe "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct" | grep displayName

[0xbadfca11]

I can reproduce with both WSL1 and WSL2 at 19002.
Zone.Identifier may not exist for various reasons, such as the "Do not save zone information in attachments" policy or deleted by Windows Smart Screen when opening a file.

[Kai-Richardson]

@therealkenc For the output of your powershell grep: displayName : Windows Defender

Also, I've been experiencing this for many versions/months, so it's not something that was introduced as of recent.

[Kai-Richardson]

@0xbadfca11 Regarding your link to the azure windows documentation, I have no Attachments key in HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments. Therefore, if the documentation is correct, If you do not configure this policy setting, Windows marks file attachments with their zone information.

[therealkenc]

If you do not configure this policy setting, Windows marks file attachments with their zone information.

I didn't configure anything "special" in my policy (almost never do as a rule) but copying the file didn't produce the artifact. It does for you and 0xbadfca11.

I suppose the experiment to try is drag a file out of Downloads and onto some Windows share on some other computer on your local network (or a VM). If that Zone.Identifier file also appears in a "normal" network share scenario then this smells by-design-Windows.

I think (?) the variable here might be in your step (1) "Download a file from an online resource into a windows folder". You didn't say how. I used Chrome, but it could have been curl. The fact that file came from https://i.imgur.com/ was long lost to the wind by the time my drag-and-drop happened.

[Kai-Richardson]

@therealkenc Here's the steps I take exactly, using Firefox (reproduced on Chrome):

1. Navigate to an image url.
2. Right click and Save Image As
3. Choose location on my Windows NTFS C: Drive, such as C:\Users\zekai\Desktop
4. Drag (Click and hold) or copy/paste (CTRL+C & CTRL+P) PNG file to a WSL filespace, such as \\wsl$\Ubuntu\home\cassini\github
5. Nothing appears at first, but click the refresh button on explorer.exe in the top right.
6. Notice new Zone.Identifier file.

Here's my output from df -Th, to list filesystem/partition information.

df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/sdb       ext4      251G  9.0G  230G   4% /
tools          9p        477G  303G  174G  64% /init
none           devtmpfs  7.3G     0  7.3G   0% /dev
none           tmpfs     7.3G  8.0K  7.3G   1% /run
none           tmpfs     7.3G     0  7.3G   0% /run/lock
none           tmpfs     7.3G     0  7.3G   0% /run/shm
none           tmpfs     7.3G     0  7.3G   0% /run/user
tmpfs          tmpfs     7.3G     0  7.3G   0% /sys/fs/cgroup
C:\            9p        477G  303G  174G  64% /mnt/c
D:\            9p        932G  531G  402G  57% /mnt/d

[therealkenc]

Notice new Zone.Identifier file.

Thanks for the detailed steps. Caught it; same repro,

Below seems to be a hint. "This file came from another computer and might be blocked to help protect this computer."

Clicking that "unblock" button cures. Which puts this (rather unfortunately) in by-design territory, and worse, out-of-scope WSL territory.

[Kai-Richardson]

@therealkenc

Clicking that "unblock" button cures. Which puts this (rather unfortunately) in by-design territory, and worse, out-of-scope WSL territory.

I would argue that having extraneous files pop into existence every time something downloaded is copied over to the WSL filesystem should be classified as a bug and not by-design.

Since these .Identifiers are quite useless once they get moved WSL, why not simply ignore the NTFS alternate file stream data during the copy process between file systems. This issue definitely has caused me a bit of pain when I download zipped directories and bring them over to WSL, leading to a proliferation of dozens of .Identifier files.

This command (PowerShell) lists all files with an associated Identifier stream in a directory:
Get-ChildItem -Recurse | Get-Item -Stream Zone.Identifier -ErrorAction SilentlyContinue | Select-Object FileName

This is how you remove them with PowerShell:
Remove-Item .\example.exe -Stream Zone.Identifier

If PowerShell has the tools to remove these stream identifiers, why can't WSL remove them upon file copy over?

[therealkenc]

why not simply ignore the NTFS alternate file stream data during the copy process between file systems

Likely because WSL doesn't have the faintest idea whether (scare quote) "those files" should be copied or not. Also because axiom that if the word "simply" is evoked, the premise is near always incorrect.

I would argue that having extraneous files pop into existence every time something downloaded is copied over to the WSL filesystem should be classified as a bug and not by-design.

Me too; although someone on the some team somewhere at MSFT thought "This file came from another computer and might be blocked" was a good idea.

This all said, I did the experiment of copying the untrused (?) file onto a local share, and there isn't any "•Zone.Identifier" shenanigans.

This issues hasn't been closed by-design. Someone over my pay grade would need to do that. If it were, you'd already know.

[riverar]

Explorer is attempting to set the NTFS ADS and WSL is not handling this correctly. The 0x003A (colon) getting altered to 0xF03A (dot) sounds like text encoding or path sanitation gone awry.

If this magic WSL$ share isn't going to support storing ADS, then it needs to drop the ADS requests altogether. Dumping files in the share is terrible UX, could affect disk space (Zone Identifiers are not the only items stored in ADS), and is useless busywork as neither Windows or Linux support this ·Zone.Identifier loose file.

Stack from a CreateFile on \\wsl$\Ubuntu\tmp\my.png:Zone.Identifier, Windows 10 18363.418:

1	FLTMGR.SYS	FltpPassThroughInternal + 0x90	0xfffff802213e35a0	C:\WINDOWS\System32\drivers\FLTMGR.SYS
2	FLTMGR.SYS	FltpCreate + 0x2f3	0xfffff8022141bd13	C:\WINDOWS\System32\drivers\FLTMGR.SYS
3	ntoskrnl.exe	IofCallDriver + 0x59	0xfffff80223831f39	C:\WINDOWS\system32\ntoskrnl.exe
4	ntoskrnl.exe	IoCallDriverWithTracing + 0x34	0xfffff80223830fe4	C:\WINDOWS\system32\ntoskrnl.exe
5	ntoskrnl.exe	IopParseDevice + 0x62b	0xfffff80223de5ffb	C:\WINDOWS\system32\ntoskrnl.exe
6	ntoskrnl.exe	IopParseFile + 0xc7	0xfffff80223ebccc7	C:\WINDOWS\system32\ntoskrnl.exe
7	ntoskrnl.exe	ObpLookupObjectName + 0x78f	0xfffff80223decfcf	C:\WINDOWS\system32\ntoskrnl.exe
8	ntoskrnl.exe	ObOpenObjectByNameEx + 0x201	0xfffff80223deb431	C:\WINDOWS\system32\ntoskrnl.exe
9	ntoskrnl.exe	IopCreateFile + 0x820	0xfffff80223e30300	C:\WINDOWS\system32\ntoskrnl.exe
10	ntoskrnl.exe	IoCreateFileEx + 0x11d	0xfffff80223e2f9ad	C:\WINDOWS\system32\ntoskrnl.exe
11	LXCORE.SYS	LxpUtilOpenFileEx + 0x356	0xfffff80226752d6a	C:\WINDOWS\system32\drivers\LXCORE.SYS
12	LXCORE.SYS	LxpUtilOpenFile + 0x45	0xfffff80226752a09	C:\WINDOWS\system32\drivers\LXCORE.SYS
13	LXCORE.SYS	LxVolFsInodeOpen + 0xa0	0xfffff802267739e0	C:\WINDOWS\system32\drivers\LXCORE.SYS
14	LXCORE.SYS	VfsInodeOpen + 0x176	0xfffff8022675f9ae	C:\WINDOWS\system32\drivers\LXCORE.SYS
15	LXCORE.SYS	VfsOpenInodeEx + 0x1bc	0xfffff8022676493c	C:\WINDOWS\system32\drivers\LXCORE.SYS
16	LXCORE.SYS	VfsOpenFile + 0xa3	0xfffff80226764723	C:\WINDOWS\system32\drivers\LXCORE.SYS
17	LXCORE.SYS	LxpUtilOpenUserPathAt + 0xab	0xfffff80226752ec3	C:\WINDOWS\system32\drivers\LXCORE.SYS
18	LXCORE.SYS	LxpOpenHelper + 0x90	0xfffff80226738528	C:\WINDOWS\system32\drivers\LXCORE.SYS
19	LXCORE.SYS	LxpSyscall_OPENAT + 0x9	0xfffff8022673faa9	C:\WINDOWS\system32\drivers\LXCORE.SYS
20	LXCORE.SYS	LxpSysDispatch + 0x114	0xfffff80226739944	C:\WINDOWS\system32\drivers\LXCORE.SYS
21	LXCORE.SYS	PicoSystemCallDispatch + 0x11	0xfffff80226756df1	C:\WINDOWS\system32\drivers\LXCORE.SYS
22	ntoskrnl.exe	PsPicoSystemCallDispatch + 0x1f	0xfffff802240cbb5f	C:\WINDOWS\system32\ntoskrnl.exe
23	ntoskrnl.exe	KiSystemServiceUser + 0x76	0xfffff802239d28f8	C:\WINDOWS\system32\ntoskrnl.exe

[thisguychris]

@therealkenc I've been getting this for months too, and I think I know why you are not getting any Zone Identifier file. If I copy and paste to a WSL2 folder, I won't see the identifier file yet. But if I go a folder up, then go back again to the original folder, I now see the identifier file.

here's the video of what I'm seeing.

I also want to add that I copied from a Downloads folder of Windows to a folder of my \\wsl$\ubuntu...\home\username\.local\_temp

I'm using WSL2, and here's my build number.
Microsoft Windows [Version 10.0.19037.1]

[Stanzilla]

Yeah this is happening here as well, pretty annoying.

[ThaDaVos]

I hope this gets fixed soon as it's really annoying when, like mentioned already, you copy a extracted zip file to the WSL directory

[thisguychris]

@therealkenc hey there, 👋🏻. I was wondering if you are now seeing this a bug after I posted details on how to reproduce it to give you more context?

If you can reproduce it, any chance we can label this as a bug?

[riverar]

@therealkenc Please label as bug.

[therealkenc]

I was wondering if you are now seeing this a bug after I posted

I reproduced it in October, quoth "Thanks for the detailed steps. Caught it; same repro",

Please label as bug.

Precedent (for better or worse) is the dev responsible makes that call. My # 1529 was opened Dec 2016 and I only took the rare liberty of marking it as a bug in May 2018 (a regretful precedent). A personal favorite # 2779 managed to make it from Dec 2017 to fixedinisiders Sept 2019 with no bug tag at all (noting # 2779 was also a terrible UX).

But in the interest of popular demand, sure. Noting the significance of the already-existing open status (and lack of by-design tag) on this issue is probably being underestimated, and the significance of the newly minted bug tag is probably being overestimated.

[riverar]

@therealkenc Thanks! It helps externals a lot when it comes to badgering the folks responsible and shows up in quantitative reporting.

[thisguychris]

Hey, @therealkenc thanks for adding the label. 👋🏻 I'm actually more interested if it's reproducible in your end, that way, everyone in this thread would be in agreement it is happening. It somehow giving a mixed signal that the bug is inconsistent. If it's consistent then it is going to be easier to debug. However, I would like to add by simply searching the label:bug, it seems it was mostly fixed or someone from MS does jump in the thread,

Judging from the screenshot it seems tagging it as a bug, seems to work 😉

[Kai-Richardson]

@thisguychris they reproduced it in this reply: #4609 (comment). Also said in their last reply.

[thisguychris]

@Kai-Richardson my bad, I totally missed that, 🙏🏻 sorry about that @therealkenc

[staticle]

A Workaround is to run cd ~ && find . -name "*:Zone.Identifier" -type f -delete

[eriksenonline]

I will not say this is a simple solution. It is a workaround for somthing we should not have in our linux files.

[NiklasBr]

An XML file got this identifier file:

[ZoneTransfer]
ZoneId=3

niklas@Fractal:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:        18.04
Codename:       bionic
niklas@Fractal:~$ uname -a
Linux Fractal 4.19.104-microsoft-standard #1 SMP Wed Feb 19 06:37:35 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[riverar]

Still a bug in Version 2004 GA, 19041.264.

[sanderkooger]

Having the same issue here. Help is welcome

[drewstaylor]

Can't repro here.

This is on 19002; whether the small version bump makes a difference I doubt. Zone.Identifier does get a quick search hit. Said functionality is news to me.

On a lark, from your WSL2 bash prompt, what is the output of:

$ powershell.exe "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct" | grep displayName

It's likely you just don't see them in file explorer, because they will only display when you have file explorer set to show hidden files.

[riverar]

@drewstaylor It's already been confirmed as reproducible, you're responding to an old post.

[SheepReaper]

I'm not convinced that this is a bug. This is the expected behavior of the ADS when downloading to a Windows share where the filesystem isn't ntfs. You're interacting with the share if you're using windows explorer to download to a wsl path. You don't see this if for example you perform file operations from within wsl or curl, but that's also expected. If you really hate the existence of those files, don't drag and drop through explorer or copy into the share. Alternatively disable the preservation of zone data via local policy. I really don't see M$ making an exception for a "magic" share. The policy you want is User Configuration\Policies\Administrative Templates\Windows Components\Attachment Manager\Do not preserve zone information in file attachments (set it to enabled)

[riverar]

@SheepReaper As mentioned in 2019, neither Windows or Linux support ·Zone.Identifier (or any other ADS) so seems pointless to generate. This was fixed in an Insider build but appears to have regressed.

@bitcrazed Can you re-open and assist here?

@therealkenc Can you re-open this?

[SheepReaper]

Ntfs supports Alternate Data Streams. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8 windows supports ADS. Explorer is sending all streams. The share fs (ext4) does not. Rather than losing information, the default behavior is to create the zone identifier file. Between wsl 1 and 2 the way to access your Linux file systems from windows was replaced with a normal Windows share. I don't know that this has ever worked the way you expect in wsl2. This is default behavior for ADS on windows...

[riverar]

@SheepReaper I understand NTFS ADS (see posts I linked to), but my point is that after being copied into \\WSL$, these · prefaced files are created. These files are not useful for any OS, so begs the question why they're created to begin with. It seems Microsoft agreed as they previously fixed the issue.

[nathanneuro]

This wasn't happening for me for the first few months of using WSL 2, but then started happening just recently. Pretty annoying. Why was the issue closed if it's still an unfixed problem?

[NiklasBr]

@nathanneuro add your voice to #7456

[richardheller]

Until fixed, just copy the files over using wsl command line the issue does not occur...

[fonnesbeck]

This is clearly still an issue. Should I open a new bug report?

[NiklasBr]

@fonnesbeck No, there is already a new issue opened: #7456

[tomba4]

@SvenGroot Can you please explain how come this issue is marked as fixed when in fact it's not?

[davidruizdiaz]

I also have the same problem and when trying to delete with the command find . -name "*:Zone.Identifier" -type f -delete it gives me the error find: cannot delete ‘./file:Zone.Identifier’: Read-only file system
Does anyone know of another way to delete the file?

[SheepReaper]

I also have the same problem and when trying to delete with the command find . -name "*:Zone.Identifier" -type f -delete it gives me the error find: cannot delete ‘./file:Zone.Identifier’: Read-only file system Does anyone know of another way to delete the file?

Whatever filesystem you're working on appears to be mounted read-only. You won't be able to delete any files on it until you address that.

@tomba4 It's the unfortunate nature of issue handling. Closed issues may as well be locked for all the attention they will get. There's already a new issue opened. Please go there and thumb up the OP to increase the visibility of the open issue: #7456

[Andrewlevvv23]

I also have the same problem and when trying to delete with the command find . -name "*:Zone.Identifier" -type f -delete it gives me the error find: cannot delete ‘./file:Zone.Identifier’: Read-only file system Does anyone know of another way to delete the file?

You don't have the correct command line, you need it like this: find . -type f -name "*.Identifier" -exec rm -f {} ;

[darylknight]

I've reformatted 3 times in the last month and followed the documentation for installing WSL each time. This still happens in Windows 11.

[s-h-a-d-o-w]

This can also start happening after an update.
If you stumble across this, it's probably too late already and we feel for you. 🫤

But at least now you know to never upgrade WSL if you're not experiencing this issue.

[widersky]

Still an issue here, very annoying :/

[aprozo]

Same here

[wuxb45]

Very annoying. Please provide an option to disable this "feature" from WSL.

[SheepReaper]

If you mount a volume formatted with NTFS, then save a file downloaded from the internet, through the wsl$ share, to a directory on the mounted NTFS volume, does it still happen?

[cianetech]

Can I just delete these files or should they not be deleted?

[JacobDB]

@cianetech I think these files just contain information about where the file came from; you can delete them so long as you trust the files. I've never had an issue deleting them.

[AntonOfTheWoods]

You guys are probably all way too young. These minor inconveniences are mere trifles compared to what we had to put up with from the 90s until a year or so ago, since which we can boot to windows and we almost don't have to use it at all!

[phush0]

same here please remove it linux do not care for these files

[SheepReaper]

This issue is no longer tracked. Please go to #7456 and upvote the OP there to gain attention.