"With the Advent of XP SP2 when a file1 is downloaded from the internet (i.e. by clicking on a link in explorer2) to an NTFS volume an Alternate Data Stream (Zone.Identifier) is created along side the downloaded file (i.e. downloadedfile.exe:zone.identifier). The content of this file is used as a security by Windows XP as security data to determine the publisher/source of the file." http://www.sandersonforensics.com/Files/ZoneIdentifier.pdf

The values in the following table are either explicitly assigned, i.e. 
URLZONE_USER_MIN = 1000 or are incrementing numbers i.e. 
URLZONE_INTRANET = 1 
URLZONE_TRUSTED = 2 
URLZONE_INTERNET = 3 
URLZONE_UNTRUSTED = 4