According to Windows: killing the Zone.Identifier NTFS alternate data stream the Zone.Information is:
The Zone.Identifier NTFS alternate data stream (ADS) is appended to Internet downloads by browsers, and inserted by most decompressors when expanding such downloads.
ZoneID=3 means it was downloaded from Internet zone (as opposed to Local Intranet etc) . Different zones are detailed in this Microsoft document About URL Security Zones.
It is not a function of the file type it is metadata indicating the files provenance.
For example on Windows I created a new file
Doc1.pdf in Word and downloaded a flight boarding pass
Test.pdf from the internet.
PS C:\PDFtest> ls
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 27/12/2019 09:51 25598 Doc1.pdf
-a---- 10/11/2019 14:24 21784 Test.pdf
Only the downloaded file contains a Zone.Identifier stream.
PS C:\PDFtest> Get-Item * -Stream zone*
PSPath : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest\Test.pdf:Zone.Identifier
PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest
PSChildName : Test.pdf:Zone.Identifier
PSDrive : C
PSProvider : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName : C:\PDFtest\Test.pdf
Stream : Zone.Identifier
Length : 151
If you then copy these files to mac the stream data is converted to a file but only in the case that there was some. This is because the filesystem (APFS) does not support streams (and indeed Windows doesn't necessarily know what filesystem it is).
A1398% cd ~/Downloads/PDFTest
A1398% ls -la
drwxr-xr-x 4 hali staff 128 Dec 27 09:11 .
drwx------+ 28 hali staff 896 Dec 27 09:11 ..
-rw-r--r--@ 1 hali staff 25598 Dec 27 09:51 Doc1.pdf
-rw-r--r--@ 1 hali staff 21784 Nov 10 14:24 Test.pdf
-rw-r--r--@ 1 hali staff 151 Nov 10 14:24 Test.pdf:Zone.Identifier
Note that if you check with
ls the name is not FileName.pdf/Zone.Identifier it is FileName.pdf:Zone.Identifier - it is just macOS displays
/ in Finder. This is the same name as seen in Windows using Powershell
Get-Item -Stream above or as mentioned in the link as seen using Nirsoft AlternateStreamView
The contents are whatever were in this NTFS stream. In my case it also contains the website I downloaded it from - the pdf was a flight ticket and has the airline name.
A1398% cat Test.pdf:Zone.Identifier
If you are not interested in this information you can remove the ADS on Windows as described in the above link:
This batch file kills the Zone.Identifier NTFS alternate data stream using the SysInternals streams tool:
if !%1!==!! goto :end
:: use caret before pipe to hide the pipe from the outermost command in the batch file
for /f "usebackq tokens=1" %%d in (`streams.exe %1 ^| find "Zone.Identifier:$DATA"`) do (
streams -d %1
Alternatively you can remove them on macOS after copying using
rm (adjusting the directory)