[German]Windows Explorer supports the packing and unpacking of ZIP archive files. However, in Windows 7 to Windows 10 this function is probably implemented differently from what other tools do. This sometimes leads to 'strange' effects, which can be explained with some background knowledge.
Advertising
Readers' tips on ZIP problems
German blog reader Al CiD send me a a link to this blog post a few days ago (thanks for that). The blog post also deals with issues, another reader thought, he had observed. However, this behaviors can be explained. So I decided to write this blog post to outline some things from scratch.
The Trigger: Issues with WSUS Offline Update
When using WSUS Offline Update, a user ran into issues. This user has downloaded the .zip file from the website into a local folder and unzipped the ZIP archive with the Windows Explorer's ZIP function into another folder. The extraction can be done with the Explorer's context menu.
But when the user tried to use WSUS Offline Update, it didn't work. The suspected cause (in the blog post linked above) is that Windows Explorer changes the files during unpacking – at least the modification date of all extracted files is updated. And a zone blocking attribute is set.
Testing myself in Windows 7 and Windows 10
I tried this on a ZIP archive file from the WSUS offline page under Windows 10 Version 1803 and Windows 7 SP 1.
Advertising
The screenshot above shows the date values (German time format) of the files in the ZIP archive in the bin subfolder. The Explorer displays these files as soon as a ZIP file is opened with a double-click. Some files have date values from previous years (e.g. 1999).
If you right-click on a ZIP archive file in the Explorer, you can extract its contents into a folder using the context menu command Extract all. If you open the folder with the unpacked files by double-clicking in the Explorer, there is a surprise.
The files have as modification date the day on which the ZIP archive was unpacked. (see picture above).
Special feature during implementation
Microsoft has implemented the ZIP function in a way, that the unzipped files are assigned the current file date – if the ZIP archive has been downloaded from the Internet. This is the case from Windows 7 SP1 up to Windows 10, as I just found out during a test. If the Internet zone 'attribute' is deleted before unpacking, the ZIP function keeps the date of the unpacked archive file.
Other tools don't do that
Should normally not be a problem, unless an application relies on unmodified files (even at the file date). A check with 7-ZIP showed that this tool stores the unmodified files from the ZIP archive in the destination folder of the hard disk.
Block tag assigned
This blog post also notes that the Explorer assigns a tag (attribute) to the unzipped files that blocks access when they come from 'another computer' (see this image and the screenshot below from my German Windows 10).
If you right-click on a file and use the Properties context menu command, the attributes of the file are displayed on the General tab. For unzipped files, the category Security appears and the unchecked Unblock check box with the text 'This file came from another computer and might be blocked to help protect this computer' is shown.
Note: The text 'This file came from another computer …' isn't precise. The entry Security is only set for files that are loaded from the Internet. This tag is missing for archives that originate from the local network and are copied to a local folder.
This is a Windows security feature that I appreciate. The operating system remembers if a file has been downloaded from the Internet (untrustable source) and sets the internet zone attribute. This is intended to prevent execution at a low trust level (more on this below).
This is, for example, the reason why CHM help files loaded from the Internet do not display any content. And that might be the reason why WSUS Offline Update didn't work in the case mentioned above.
Within this article I used the term zone attribute (or bit). Strictly speaking, it is not an NTFS attribute. Files from the Internet are assigned an NTFS ADS (Alternate Data Stream) information with zone information.
Also this zone information is not set or considered with tools like 7-Zip. Personally, however, I feel that Microsoft's implementation is more clever because it passes on additional security information about the zone of origin with the files. It prevents that ZIP files taken from external sources lose the zone information during unpacking.
A small additional test
I run a small test and packed some files on the local Windows 10 computer into a ZIP archive, using Windows Explorer. Then I unpacked them again in Explorer. Within this scenario, the file date is preserved during unpacking. And no block tag is set in the category Security for the unpacked files. So the behavior described above is only value for ZIP archives, that have set the internet zone information.
A second test with a ZIP file copies from a network share of my local network showed that there is no NTFS ADS (Alternate Data Stream) information generated for this file. After copying over the network to a local folder, the category Security is missing in the file properties. And the ZIP function of the Explorer behaves as expected, i.e. the file date from the ZIP archive is preserved.
How to delete the security information
You can easily delete the security attribute derived from the internet zone information of the files downloaded from the Internet. Right-click on the file and select Properties from the context menu. Then, on the General tab, check the Unblock check box within the category Security.
Under Windows 7, the relevant properties page looks like the one shown in the picture above – all you have to do is click on the Allow/Unblock button to delete the internet zone information.
This is known since years, and after downloading files from the Internet, I clean the internet zone flag within the files properties, to avoid such issues as described above. But you should keep that in mind. Some technical explanations and backgrounds to the NTFS Alternative Data Streams (NTFS ADS) may be found in my blog post Information about Windows NTFS Alternative Data Streams.
