0. Disable saving the zone identifier - or clear it with a tool. This information is most likely preserved when copying a file, and depending on the tool and format, it might get into a compressed archive to be restored later.
There's a Total Commander plugin which can show where a given file was downloaded from. Not sure which one it is as I have multiple installed. Probably this one: https://totalcmd.net/plugring/ntfsstreamviewer.html
https://www.digital-detective.net/forensic-analysis-of-zone-...
There's a Total Commander plugin which can show where a given file was downloaded from. Not sure which one it is as I have multiple installed. Probably this one: https://totalcmd.net/plugring/ntfsstreamviewer.html