What are these extra /Zone.Identifier files created during Windows Remote Desktop file transfer? Steps to Reproduce


Installs Windows Remote Desktop client for mac
Connect to a Windows 10 server, mounting a local folder over the connection
On the remote server, copy a pdf (e.g. my_file.pdf from a remote folder to the mounted Mac folder
Look at the mounted Mac folder locally on the Mac


Observed behavior

The pdf I copied is there.

A second file with the same name plus /Zone.Identifier is there. (i.e. my_file.pdf/Zone.Identifier (despite the slash, that's one file name.)

The contents when viewed in a text editor is:

[ZoneTransfer]
ZoneId=3


Issue

One Drive cannot sync files with slashes in their file name, so I get lots of errors whenever I do this, and I have to manually delete each one.

Questions


What is this file?
What put it there? Was it the remote desktop client?
Why doesn't it go away when I close the connection?
Why doesn't it happen for .txt files?
How do I avoid creating such a file?
According to Windows: killing the Zone.Identifier NTFS alternate data stream the Zone.Information is: 


  The Zone.Identifier NTFS alternate data stream (ADS) is appended to Internet downloads by browsers, and inserted by most decompressors when expanding such downloads.


ZoneID=3 means it was downloaded from Internet zone (as opposed to Local Intranet etc) .  Different zones are detailed in this Microsoft document About URL Security Zones.  

It is not a function of the file type it is metadata indicating the files provenance.   



For example on Windows I created a new file Doc1.pdf in Word and downloaded a flight boarding pass Test.pdf from the internet.

PS C:\PDFtest&gt; ls

    Directory: C:\PDFtest

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       27/12/2019     09:51          25598 Doc1.pdf
-a----       10/11/2019     14:24          21784 Test.pdf


Only the downloaded file contains a Zone.Identifier stream.

PS C:\PDFtest&gt; Get-Item * -Stream zone*

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest\Test.pdf:Zone.Identifier
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest
PSChildName   : Test.pdf:Zone.Identifier
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\PDFtest\Test.pdf
Stream        : Zone.Identifier
Length        : 151

PS C:\PDFtest&gt;


If you then copy these files to mac the stream data is converted to a file but only in the case that there was some.  This is because the filesystem (APFS) does not support streams (and indeed Windows doesn't necessarily know what filesystem it is).    

A1398% cd ~/Downloads/PDFTest
A1398% ls -la
total 56
drwxr-xr-x   4 hali  staff    128 Dec 27 09:11 .
drwx------+ 28 hali  staff    896 Dec 27 09:11 ..
-rw-r--r--@  1 hali  staff  25598 Dec 27 09:51 Doc1.pdf
-rw-r--r--@  1 hali  staff  21784 Nov 10 14:24 Test.pdf
-rw-r--r--@  1 hali  staff    151 Nov 10 14:24 Test.pdf:Zone.Identifier


Note that if you check with ls the name is not FileName.pdf/Zone.Identifier it is FileName.pdf:Zone.Identifier - it is just macOS displays : as / in Finder. This is the same name as seen in Windows using Powershell Get-Item -Stream above or as mentioned in the link as seen using Nirsoft AlternateStreamView

 

The contents are whatever were in this NTFS stream. In my case it also contains the website I downloaded it from - the pdf was a flight ticket and has the airline name.

A1398% cat Test.pdf:Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://booking.nouvelair.com/web/Itinerary.xhtml
HostUrl=https://booking.nouvelair.com/web/generatePDFServlet




If you are not interested in this information you can remove the ADS on Windows as described in the above link:


  This batch file kills  the Zone.Identifier NTFS alternate data stream using the SysInternals streams tool:

@echo off
  if !%1!==!! goto :end
  :: use caret before pipe to hide the pipe from the outermost command in the batch file
  for /f "usebackq tokens=1" %%d in (`streams.exe %1 ^| find "Zone.Identifier:$DATA"`) do (
    goto :kill
  )
  goto :end
:kill
  streams -d %1
:end



Alternatively you can remove them on macOS after copying using rm (adjusting the directory)

rm ~/Downloads/PDFTest/*:Zone.Identifier