Lion Cipher Lab
Prove where a file came from with the Zone.Identifier stream (Mark of the Web)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
In almost every intrusion that starts with a user, an investigator has to answer one plain question about a suspicious file: where did it come from? Did it arrive as an email attachment, a browser download, a file copied off a share, or was it created on the machine by something already running there? Windows quietly records part of that answer. When a browser or mail client saves a file from the Internet, it attaches a tiny hidden text stream called Zone.Identifier, the Mark of the Web, recording the security zone and often the exact download URL and the page that linked to it. That same…
What you'll learn
- Explaining what an NTFS alternate data stream is and why Zone.Identifier hides in one
- Reading a file's Mark of the Web three ways: dir /r, Get-Item -Stream *, Get-Content -Stream Zone.Identifier
- Mapping ZoneId 0-4 to Windows security zones and reading HostUrl and ReferrerUrl as download provenance
- Measuring which copy, extract and download operations keep or silently drop the mark
- Writing a stdlib Python triage script that inventories every stream and flags risky types, contradictions and lost marks
- Stating what the mark can and cannot prove, including why a missing stream is not proof a file was made locally
Steps in this lab
- What the Mark of the Web is, in one picture
- Decode the zone numbers before you read a single stream
- See a real mark on your own machine
- Measure which everyday operations keep the mark and which drop it
- Build the evidence folder for the case
- Write the triage script: inventory, then three rules
- Score the naive view against the triage rules
- No NTFS? Run the same analysis on the fixture
- What the mark proves, and what it never can
- When to reach for this, and how a pro does it better