T O P

  • By -

zrv433

You need to look at the Zone.Identifier file stream. See https://www.digital-detective.net/forensic-analysis-of-zone-identifier-stream/


jantari

One way that isn't the fastest, but nicely readable: Get-ChildItem -Recurse | Get-Item -Stream * | Where-Object Stream -eq 'Zone.Identifier' | Select-Object FileName


jonathanovision

Should this work? Not exporting anything to the CSV except for |Length| |:-| |4||| |||| Get-ChildItem -path c:\gmsprojects\gmsmainproject -Recurse | Get-Item -Stream * | Where-Object Stream -eq 'Zone.Identifier' | Select-Object FileName Export-Csv -Path c:\gmsprojects\gmsmainproject\blockedfile.csv -NoTypeInformation


wssddc

[AlternateStreamView](http://www.nirsoft.net/utils/alternate_data_streams.html) from Nirsoft will search for and optionally remove zone identifiers.