See file flow from Windows 8 built-in SmartScreen

The SmartScreen feature was originally designed to protect users from dangerous or phishing sites, and this functionality has been accepted by the system in Windows 8. If you open a program downloaded from the network, you will get the following tips:

The system checks the file when it is opened, and pops up the balloon if it does not meet certain rules. When I first started using Windows 8, I was puzzled by the hint that the program was broken. In fact, the system for file processing is different. There are a lot of ways to shut it down on the web, and here's not the point, so let's see where the file is going to make the system think it's unsafe.

For its right click, you can find a small portion of the property below (red box):

Prompted us to get this file from somewhere else, so for security, the system automatically locked, click on the button can unlock and normal access, and then will not be reminded again. When learning about NTFS, I found the secret: The system uses a special file stream to hold this information, but the common method is not to see such content. The stream name of the file stream is Zone.identifier, the size is only 20来 byte, the view needs to use the command prompt, entered at the command prompt:

More < IFEO_V2.exe:Zone.Identifier

You will see the following:

[Zonetransfer]

Zoneid=3

This is actually an identifier, where ZoneID represents the region in which it is located. The area here is the locale that corresponds to IE, 1 represents the trusted site, and 2 represents the restricted site for the local intranet,3 representative internet,4. According to the default settings, 1 and 2 can be used normally without prompting, 3 will get the prompt. If ZoneID is 4, you get the following error message:

The system considers this to be an untrusted program, so the system refuses to open the file. This program cannot be run unless you manually unlock or adjust the security settings.

Microsoft provides a tool for viewing file streams: Streams.exe uses this tool to view file streams for certain files or folders, which can list details such as the size and name of the stream. View a file flow specific content using "more < filename: Stream name" (without quotes). Because the file name in Windows cannot contain a colon, it is not possible to use a common desktop program to open the contents of the stream.