Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Zone.Identifier Files when copying from Windows to WSL filestructure #4609

Closed
Kai-Richardson opened this issue Oct 21, 2019 · 137 comments
Closed

Comments

@Kai-Richardson
Copy link

Kai-Richardson commented Oct 21, 2019

  • Windows build number: Microsoft Windows [Version 10.0.18990.1]

uname -a produces: Linux 4.19.67-microsoft-standard #1 SMP Sun Aug 18 13:37:54 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

  • What you're doing and what's happening: This occurs when using Windows Explorer.
  1. Download a file from an online resource into a windows folder. For example, this image downloaded into your Downloads folder.
  2. Drag/Copy/Move said file into a WSL directory.
  3. Notice the file that is also created, named like "movedfile•Zone.Identifier", but instead of a bullet it is the character 0xF03A (Unicode: U+F03A). It does render like a bullet in Windows Explorer though.
  • What's wrong / what should be happening instead: The filename•Zone.Identifier NFTS files should not be created.

Contents of the Zone Identifier file are as to be expected, my sample having the contents:

[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://i.imgur.com/7uEP6ds.png
HostUrl=https://i.imgur.com/7uEP6ds.png

Image:
image

@Kai-Richardson Kai-Richardson changed the title Zone.Idenfitier Files when copying from Windows to WSL filestructure Zone.Identifier Files when copying from Windows to WSL filestructure Oct 21, 2019
@therealkenc
Copy link
Collaborator

Can't repro here.

image

This is on 19002; whether the small version bump makes a difference I doubt. Zone.Identifier does get a quick search hit. Said functionality is news to me.

On a lark, from your WSL2 bash prompt, what is the output of:

$ powershell.exe "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct" | grep displayName

@0xbadfca11
Copy link

I can reproduce with both WSL1 and WSL2 at 19002.
Zone.Identifier may not exist for various reasons, such as the "Do not save zone information in attachments" policy or deleted by Windows Smart Screen when opening a file.
image

@Kai-Richardson
Copy link
Author

Kai-Richardson commented Oct 21, 2019

@therealkenc For the output of your powershell grep: displayName : Windows Defender

Also, I've been experiencing this for many versions/months, so it's not something that was introduced as of recent.

@Kai-Richardson
Copy link
Author

@0xbadfca11 Regarding your link to the azure windows documentation, I have no Attachments key in HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments. Therefore, if the documentation is correct, If you do not configure this policy setting, Windows marks file attachments with their zone information.

@therealkenc
Copy link
Collaborator

If you do not configure this policy setting, Windows marks file attachments with their zone information.

I didn't configure anything "special" in my policy (almost never do as a rule) but copying the file didn't produce the artifact. It does for you and 0xbadfca11.

I suppose the experiment to try is drag a file out of Downloads and onto some Windows share on some other computer on your local network (or a VM). If that Zone.Identifier file also appears in a "normal" network share scenario then this smells by-design-Windows.

I think (?) the variable here might be in your step (1) "Download a file from an online resource into a windows folder". You didn't say how. I used Chrome, but it could have been curl. The fact that file came from https://i.imgur.com/ was long lost to the wind by the time my drag-and-drop happened.

@Kai-Richardson
Copy link
Author

@therealkenc Here's the steps I take exactly, using Firefox (reproduced on Chrome):

  1. Navigate to an image url.
  2. Right click and Save Image As
  3. Choose location on my Windows NTFS C: Drive, such as C:\Users\zekai\Desktop
  4. Drag (Click and hold) or copy/paste (CTRL+C & CTRL+P) PNG file to a WSL filespace, such as \\wsl$\Ubuntu\home\cassini\github
  5. Nothing appears at first, but click the refresh button on explorer.exe in the top right.
  6. Notice new Zone.Identifier file.

Here's my output from df -Th, to list filesystem/partition information.

df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/sdb       ext4      251G  9.0G  230G   4% /
tools          9p        477G  303G  174G  64% /init
none           devtmpfs  7.3G     0  7.3G   0% /dev
none           tmpfs     7.3G  8.0K  7.3G   1% /run
none           tmpfs     7.3G     0  7.3G   0% /run/lock
none           tmpfs     7.3G     0  7.3G   0% /run/shm
none           tmpfs     7.3G     0  7.3G   0% /run/user
tmpfs          tmpfs     7.3G     0  7.3G   0% /sys/fs/cgroup
C:\            9p        477G  303G  174G  64% /mnt/c
D:\            9p        932G  531G  402G  57% /mnt/d

@therealkenc
Copy link
Collaborator

Notice new Zone.Identifier file.

Thanks for the detailed steps. Caught it; same repro,

image

Below seems to be a hint. "This file came from another computer and might be blocked to help protect this computer."

image

Clicking that "unblock" button cures. Which puts this (rather unfortunately) in by-design territory, and worse, out-of-scope WSL territory.

@Kai-Richardson
Copy link
Author

@therealkenc

Clicking that "unblock" button cures. Which puts this (rather unfortunately) in by-design territory, and worse, out-of-scope WSL territory.

I would argue that having extraneous files pop into existence every time something downloaded is copied over to the WSL filesystem should be classified as a bug and not by-design.

Since these .Identifiers are quite useless once they get moved WSL, why not simply ignore the NTFS alternate file stream data during the copy process between file systems. This issue definitely has caused me a bit of pain when I download zipped directories and bring them over to WSL, leading to a proliferation of dozens of .Identifier files.

This command (PowerShell) lists all files with an associated Identifier stream in a directory:
Get-ChildItem -Recurse | Get-Item -Stream Zone.Identifier -ErrorAction SilentlyContinue | Select-Object FileName

This is how you remove them with PowerShell:
Remove-Item .\example.exe -Stream Zone.Identifier

If PowerShell has the tools to remove these stream identifiers, why can't WSL remove them upon file copy over?

@therealkenc
Copy link
Collaborator

why not simply ignore the NTFS alternate file stream data during the copy process between file systems

Likely because WSL doesn't have the faintest idea whether (scare quote) "those files" should be copied or not. Also because axiom that if the word "simply" is evoked, the premise is near always incorrect.

I would argue that having extraneous files pop into existence every time something downloaded is copied over to the WSL filesystem should be classified as a bug and not by-design.

Me too; although someone on the some team somewhere at MSFT thought "This file came from another computer and might be blocked" was a good idea.

This all said, I did the experiment of copying the untrused (?) file onto a local share, and there isn't any "•Zone.Identifier" shenanigans.

image

This issues hasn't been closed by-design. Someone over my pay grade would need to do that. If it were, you'd already know.

@riverar
Copy link

riverar commented Nov 4, 2019

Explorer is attempting to set the NTFS ADS and WSL is not handling this correctly. The 0x003A (colon) getting altered to 0xF03A (dot) sounds like text encoding or path sanitation gone awry.

If this magic WSL$ share isn't going to support storing ADS, then it needs to drop the ADS requests altogether. Dumping files in the share is terrible UX, could affect disk space (Zone Identifiers are not the only items stored in ADS), and is useless busywork as neither Windows or Linux support this ·Zone.Identifier loose file.

Stack from a CreateFile on \\wsl$\Ubuntu\tmp\my.png:Zone.Identifier, Windows 10 18363.418:

1	FLTMGR.SYS	FltpPassThroughInternal + 0x90	0xfffff802213e35a0	C:\WINDOWS\System32\drivers\FLTMGR.SYS
2	FLTMGR.SYS	FltpCreate + 0x2f3	0xfffff8022141bd13	C:\WINDOWS\System32\drivers\FLTMGR.SYS
3	ntoskrnl.exe	IofCallDriver + 0x59	0xfffff80223831f39	C:\WINDOWS\system32\ntoskrnl.exe
4	ntoskrnl.exe	IoCallDriverWithTracing + 0x34	0xfffff80223830fe4	C:\WINDOWS\system32\ntoskrnl.exe
5	ntoskrnl.exe	IopParseDevice + 0x62b	0xfffff80223de5ffb	C:\WINDOWS\system32\ntoskrnl.exe
6	ntoskrnl.exe	IopParseFile + 0xc7	0xfffff80223ebccc7	C:\WINDOWS\system32\ntoskrnl.exe
7	ntoskrnl.exe	ObpLookupObjectName + 0x78f	0xfffff80223decfcf	C:\WINDOWS\system32\ntoskrnl.exe
8	ntoskrnl.exe	ObOpenObjectByNameEx + 0x201	0xfffff80223deb431	C:\WINDOWS\system32\ntoskrnl.exe
9	ntoskrnl.exe	IopCreateFile + 0x820	0xfffff80223e30300	C:\WINDOWS\system32\ntoskrnl.exe
10	ntoskrnl.exe	IoCreateFileEx + 0x11d	0xfffff80223e2f9ad	C:\WINDOWS\system32\ntoskrnl.exe
11	LXCORE.SYS	LxpUtilOpenFileEx + 0x356	0xfffff80226752d6a	C:\WINDOWS\system32\drivers\LXCORE.SYS
12	LXCORE.SYS	LxpUtilOpenFile + 0x45	0xfffff80226752a09	C:\WINDOWS\system32\drivers\LXCORE.SYS
13	LXCORE.SYS	LxVolFsInodeOpen + 0xa0	0xfffff802267739e0	C:\WINDOWS\system32\drivers\LXCORE.SYS
14	LXCORE.SYS	VfsInodeOpen + 0x176	0xfffff8022675f9ae	C:\WINDOWS\system32\drivers\LXCORE.SYS
15	LXCORE.SYS	VfsOpenInodeEx + 0x1bc	0xfffff8022676493c	C:\WINDOWS\system32\drivers\LXCORE.SYS
16	LXCORE.SYS	VfsOpenFile + 0xa3	0xfffff80226764723	C:\WINDOWS\system32\drivers\LXCORE.SYS
17	LXCORE.SYS	LxpUtilOpenUserPathAt + 0xab	0xfffff80226752ec3	C:\WINDOWS\system32\drivers\LXCORE.SYS
18	LXCORE.SYS	LxpOpenHelper + 0x90	0xfffff80226738528	C:\WINDOWS\system32\drivers\LXCORE.SYS
19	LXCORE.SYS	LxpSyscall_OPENAT + 0x9	0xfffff8022673faa9	C:\WINDOWS\system32\drivers\LXCORE.SYS
20	LXCORE.SYS	LxpSysDispatch + 0x114	0xfffff80226739944	C:\WINDOWS\system32\drivers\LXCORE.SYS
21	LXCORE.SYS	PicoSystemCallDispatch + 0x11	0xfffff80226756df1	C:\WINDOWS\system32\drivers\LXCORE.SYS
22	ntoskrnl.exe	PsPicoSystemCallDispatch + 0x1f	0xfffff802240cbb5f	C:\WINDOWS\system32\ntoskrnl.exe
23	ntoskrnl.exe	KiSystemServiceUser + 0x76	0xfffff802239d28f8	C:\WINDOWS\system32\ntoskrnl.exe

@chiefjester
Copy link

chiefjester commented Dec 10, 2019

@therealkenc I've been getting this for months too, and I think I know why you are not getting any Zone Identifier file. If I copy and paste to a WSL2 folder, I won't see the identifier file yet. But if I go a folder up, then go back again to the original folder, I now see the identifier file.

here's the video of what I'm seeing.

I also want to add that I copied from a Downloads folder of Windows to a folder of my \\wsl$\ubuntu...\home\username\.local\_temp

I'm using WSL2, and here's my build number.
Microsoft Windows [Version 10.0.19037.1]

@Stanzilla
Copy link

Yeah this is happening here as well, pretty annoying.

@ThaDaVos
Copy link

I hope this gets fixed soon as it's really annoying when, like mentioned already, you copy a extracted zip file to the WSL directory

@chiefjester
Copy link

@therealkenc hey there, 👋🏻. I was wondering if you are now seeing this a bug after I posted details on how to reproduce it to give you more context?

If you can reproduce it, any chance we can label this as a bug?

@riverar
Copy link

riverar commented Feb 19, 2020

@therealkenc Please label as bug.

@therealkenc
Copy link
Collaborator

therealkenc commented Feb 19, 2020

I was wondering if you are now seeing this a bug after I posted

I reproduced it in October, quoth "Thanks for the detailed steps. Caught it; same repro",

Please label as bug.

Precedent (for better or worse) is the dev responsible makes that call. My # 1529 was opened Dec 2016 and I only took the rare liberty of marking it as a bug in May 2018 (a regretful precedent). A personal favorite # 2779 managed to make it from Dec 2017 to fixedinisiders Sept 2019 with no bug tag at all (noting # 2779 was also a terrible UX).

But in the interest of popular demand, sure. Noting the significance of the already-existing open status (and lack of by-design tag) on this issue is probably being underestimated, and the significance of the newly minted bug tag is probably being overestimated.

@riverar
Copy link

riverar commented Feb 19, 2020

@therealkenc Thanks! It helps externals a lot when it comes to badgering the folks responsible and shows up in quantitative reporting.

@chiefjester
Copy link

chiefjester commented Feb 19, 2020

Hey, @therealkenc thanks for adding the label. 👋🏻 I'm actually more interested if it's reproducible in your end, that way, everyone in this thread would be in agreement it is happening. It somehow giving a mixed signal that the bug is inconsistent. If it's consistent then it is going to be easier to debug. However, I would like to add by simply searching the label:bug, it seems it was mostly fixed or someone from MS does jump in the thread,

image

Judging from the screenshot it seems tagging it as a bug, seems to work 😉

@Kai-Richardson
Copy link
Author

Kai-Richardson commented Feb 20, 2020

@thisguychris they reproduced it in this reply: #4609 (comment). Also said in their last reply.

@chiefjester
Copy link

@Kai-Richardson my bad, I totally missed that, 🙏🏻 sorry about that @therealkenc

@staticle
Copy link

staticle commented Apr 17, 2020

A Workaround is to run cd ~ && find . -name "*:Zone.Identifier" -type f -delete

@eriksenonline
Copy link

I will not say this is a simple solution. It is a workaround for somthing we should not have in our linux files.

@NiklasBr
Copy link

An XML file got this identifier file:

[ZoneTransfer]
ZoneId=3
niklas@Fractal:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:        18.04
Codename:       bionic
niklas@Fractal:~$ uname -a
Linux Fractal 4.19.104-microsoft-standard #1 SMP Wed Feb 19 06:37:35 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

@riverar
Copy link

riverar commented Jun 12, 2020

Still a bug in Version 2004 GA, 19041.264.

@sanderkooger
Copy link

Having the same issue here. Help is welcome

@drewstaylor
Copy link

drewstaylor commented Jun 16, 2020

Can't repro here.

image

This is on 19002; whether the small version bump makes a difference I doubt. Zone.Identifier does get a quick search hit. Said functionality is news to me.

On a lark, from your WSL2 bash prompt, what is the output of:

$ powershell.exe "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct" | grep displayName

It's likely you just don't see them in file explorer, because they will only display when you have file explorer set to show hidden files.

@riverar
Copy link

riverar commented Jun 16, 2020

@drewstaylor It's already been confirmed as reproducible, you're responding to an old post.

@wuxb45
Copy link

wuxb45 commented Oct 11, 2023

Very annoying. Please provide an option to disable this "feature" from WSL.

@SheepReaper
Copy link

If you mount a volume formatted with NTFS, then save a file downloaded from the internet, through the wsl$ share, to a directory on the mounted NTFS volume, does it still happen?

@cianetech
Copy link

Can I just delete these files or should they not be deleted?

@JacobDB
Copy link

JacobDB commented Oct 26, 2023

@cianetech I think these files just contain information about where the file came from; you can delete them so long as you trust the files. I've never had an issue deleting them.

@AntonOfTheWoods
Copy link

You guys are probably all way too young. These minor inconveniences are mere trifles compared to what we had to put up with from the 90s until a year or so ago, since which we can boot to windows and we almost don't have to use it at all!

@phush0
Copy link

phush0 commented Nov 16, 2023

same here please remove it linux do not care for these files

@SheepReaper
Copy link

This issue is no longer tracked. Please go to #7456 and upvote the OP there to gain attention.

@rileysjc
Copy link

rileysjc commented Jan 2, 2024

Dear Microsoft, it's been 30 years. We're obivously not going to use Internet Explorer at this point.
These files are used by the IE/Scripting subsystem to assist in enforcing security boundaries based on the origin, i.e. http://evil.com/script.js != C:\script.js, so don't allow it to be executed as if it was local script. It appears if you create a directory junction, symbolic link, shortcut,etc... to a location within a WSL filesystem and then save a file from a Windows instanced application (e.g. Chrome) these files will get populated into the WSL filesystem. I imagine, for reasons like this - Explorer's dialogs do not openly expose WSL locations to enable a user to save content to WSL locations. "Crossing the streams" between NTFS and *nix filesystems generally leads to bad things - if nothing else real poor performance with disk operations. Workaround/Solution, start the application from within WSL by taking advantage of WSLg and use this to save into the WSL filesystem. I have some aliases I use for the usual apps to do this, side note to preserve or alter the UI scale to match your Windows environment you can do something like this:
...
export GDK_SCALE=2
export QT_SCALE_FACTOR=2
/usr/bin/google-chrome $1 &>/dev/null&
...

@rileysjc
Copy link

rileysjc commented Jan 2, 2024

You guys are probably all way too young. These minor inconveniences are mere trifles compared to what we had to put up with from the 90s until a year or so ago, since which we can boot to windows and we almost don't have to use it at all!

I still have my slackware 1.0 disk I "liberated" from the back of a book during my stint as a delinquent. If we took away Google, tech books, youtube, armies of people to ask questions... there'd be 50 of us online... and the Internet would be soooo fast. :)

ken-tn added a commit to ken-tn/gymnasium-exploration that referenced this issue Jan 10, 2024
MattFranklin-Rapid added a commit to RAPID-Platform-Projects/Rapid-Docs that referenced this issue Feb 5, 2024
According to some light [googling])microsoft/WSL#4609) it looks like this isn't a real file. When trying to pull the branch on windows this invalid extension prevents it so I'm removing it under the assumption it's trash
MattFranklin-Rapid added a commit to RAPID-Platform-Projects/Rapid-Docs that referenced this issue Feb 5, 2024
* Footer has been SWIZZLED! it now matches rapidplatform.com

* adding slanty svg to bottom of hero banner

* Delete static/img/rpd_white.svg:Zone.Identifier

According to some light [googling])microsoft/WSL#4609) it looks like this isn't a real file. When trying to pull the branch on windows this invalid extension prevents it so I'm removing it under the assumption it's trash

---------

Co-authored-by: MattFranklin-Rapid <[email protected]>
@Octopusmode
Copy link

Octopusmode commented Feb 8, 2024

I hope this gets fixed soon as it's really annoying when, like mentioned already, you copy a extracted zip file to the WSL directory

Got this bug in 2024.
find /path/to/directory -type f -name "*.Identifier" -exec rm -f {} \; as temporary solition

@PedroM25
Copy link

This is still happening to me as well

@SheepReaper
Copy link

This issue is no longer tracked. Please go to #7456 and upvote the OP there to gain attention. @rileysjc @Octopusmode @PedroM25

@adinamarca
Copy link

Still happening.

Answer by @Octopusmode worked!

I hope this gets fixed soon as it's really annoying when, like mentioned already, you copy a extracted zip file to the WSL directory

Got this bug in 2024. find /path/to/directory -type f -name "*.Identifier" -exec rm -f {} \; as temporary solition

@italocjs
Copy link

italocjs commented Jul 2, 2024

Started happening this week when i run python scripts over wsl.

@wzr0108
Copy link

wzr0108 commented Jul 21, 2024

find . -name "*:Zone.Identifier" -type f -delete

it works for me

@italocjs
Copy link

Why has this been closed? this is a nightmare! all my scripts are getting broken because windows touch and create those files. i always have to do a recursive delete (as suggested above)

@nsanden
Copy link

nsanden commented Jul 24, 2024

Don't close...

@dkumza
Copy link

dkumza commented Jul 26, 2024

error persist

@italocjs
Copy link

image

Please reopen! not fixed, and causes numerous programs and scripts to break

@SheepReaper
Copy link

This issue is no longer tracked. Please go to #7456 and upvote the OP there to gain attention. @rileysjc @Octopusmode @PedroM25

Please follow and up vote the other issue.

@OliverRC
Copy link

OliverRC commented Oct 7, 2024

Still happens

@NiklasBr
Copy link

NiklasBr commented Oct 7, 2024

This issue is no longer tracked. Please go to #7456 and upvote the OP there to gain attention @OliverRC.

@ttodua
Copy link

ttodua commented Jan 4, 2025

(source: https://superuser.com/a/1847682/249349 )

  1. in Start, search for gpedit.msc
  2. navigate to User Configuration > Administratives Templates > Windows Components > Attachment Manager.
  3. Double-click on Do not preserve zone information in file attachment and set it to enabled > ok

@italocjs
Copy link

italocjs commented Jan 6, 2025

Huh, so nearly 6 years and still nothing?? what a shame!...

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests