I have an ext4 drive which is available to my windows XP VirtualBox as a shared folder. When working with files across ubuntu and windows I sometimes see these autogenerated files with Zone.Identifier:$DATA appended to the name. For example, if I have the file


Then I will get a small annoying file like


The contents of the file:


They seem to be created any time I write a file to the ext4 drive from within my windows virtual machine. I seem to be able to safely delete them without any obvious consequences.

What are these files for, and if they're useless how can I prevent them from being generated in the first place?

  • You can delete existing alternate data streams using streams.exe utility available in Windows Sysinternals Suite. Commented Jan 25, 2017 at 13:15

2 Answers 2


I found the place to disable them, at least in WinXP. Run gpedit.msc and then configure as below:

enter image description here

  • 2
    Nice one - thanks for sharing the solution. I didn't have the "Attachment Manager" entry, but found elsewhere that it could be added by right-click on "Administrative Templates", choose "Add/Remove templates", and add the "system.adm" template. After that I was able to enable the "Do not preserve zone info..." option.
    – Steinar
    Commented Mar 30, 2013 at 13:54
  • Just found this having the same problem in Windows 10, accessing an NFS resource mounted in RHEL 7.6. Commented Jul 26, 2019 at 15:39
  • Alas, this policy doesn't work in Windows 7 guest system. If some file is saved to the Shared Folder, Identifier file is still created.
    – whtyger
    Commented Oct 18, 2021 at 16:52

That file is for storing an NTFS Alternate Data Stream - it's a feature that basically allows any file to have a number of hidden files inside it.

I think that particular stream is written when you download something from the net - Windows can then display that nice "Security Warning" dialog box when you run it and offer to show you an EXEs digital certificate for example. Going to Properties and clicking Unblock may remove this, and there might be a setting to disable it somewhere in Windows.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .