# Get
Get-Item * -Stream Zone.Identifier -ErrorAction SilentlyContinue
# Read
Get-Content * -Stream Zone.Identifier -ErrorAction SilentlyContinue
It helps answer:
- Was the file downloaded?
- From where?
- Via which URL?
- Did user click something?
- Was it copied internally instead?
Zone IDs Meaning
| ZoneId | Meaning |
|---|---|
| 0 | Local Machine |
| 1 | Local Intranet |
| 2 | Trusted Sites |
| 3 | Internet |
| 4 | Restricted |