...
With this release of HstEx®, we have added the ability to search and recover MFT entries containing resident Zone.Identifier Alternate Data Streams. When recovered, this data can easily be loaded into NetAnalysis and examinedThe Zone.Identifier stream, associated with a download, contains a rich store of properties that may be relevant to an investigation. NetAnalysis® provides an easy way to examine, and perform analysis on these streams. HstEx® allows an easy way to process an entire forensic image (or other source) recovering Zone.Identifier streams contained within live and deleted MFT entries. HstEx® can also recover this data even if the file has been deleted, the volume has been formatted, or the partition deleted.
Change Log
The full list of changes can be found here: HstEx® v5.1 Change Log.
...