This script is designed to parse "Zone.Identifier" alternate data streams, which are sometimes referred to as "Marks of the Web" and can help to identify files downloaded from the Internet.
Output is via bookmarks, the console, and a tab-delimited spreadsheet file.
This script was developed for use in EnCase training. For more details, please click the following link: