cgsecurity.org

I was sorting through the files recovered and placed in the recup_dir.# folders and there are these weird .ini files (f3625632.ini) in with the other files. When opened they say something like this:

[ZoneTransfer]
ZoneId=3
; ReferrerUrl=https://photos.google.com/search/_cAF1QipNVTGtjuX-SnE3DHPLXL5hLkO9uNg2tnKw_xxxxxx%20xxxxxxxxxx/photo/AF1QipOmVXpNya5qtw0Ao_Ca9ug4FnLvaZuHBVN0jBKy
HostUrl=https://lh3.googleusercontent.com/fife/ABSRlIp5y0kARjCj3eLUAWkek90jT0Bt8W5E6tMQInQDNUaQbYQwVHGxRzsdo2njH3aDbJ-OD3O0sJ8lyuFG-c7r88niC9VbMxB-rrRmKBYwVjEau4XhzSzaw41HOo62aBd4ZXc5D0grm7gJ3dZ9XRsACknqOFaXW9V5nc-w29oaeTr434BexWA5oHU-Mv4igv9iMAJKnPVsi91GIAgzRhVXtN4_bWJwTcxGpwFcscqyoYbO7inRZrNz8OMGirH3-D75rCTmNsOJ-KCUk-w-lJdgXqHCJGxz6xBl9eLUFQtdOvTeHEZPeifrn8FRPumvYY2xf_0y_kULJY7fmAJPPJIph0tPV6hTTN3CaEo-O6_5BJFThoorKiaHcB4jBmZX9nsJs3uhp54KhLoUrpY2jD-Xh2xg6SivK3e2hsJlPp-VUnTfDToAzoLeJZTAtgRDEPrVc0ndPHU8VemGhS4USIICNnziuk20xO09JxuetZfXR3EFTIQf-HhkT4hPImr8eYVW4kclIFeCl7ttugg7dMD6q40gSvCUgIfwQxc3KpTWbzIm6_Z5dyTbsQtqNGdBqofGBGIAequI7cRTyL2Ms2tqN1wElg6StZSkAo_cZ99UJSEng4JJwqG_QPx3WqMyfelK_YS3LS8klUNiPM49l2NfdtIpp5VlQeeo_xJkXgQzHexLV2Iu3CptXYxwK31-TblUxCBlYaZLLS3SvNLcwGc59CxgUWjn668M8jopQzsaewh0Yk4wyrY?authuser=0

What the hell are these files? Why do they have referrerUrl to places like Google photos or onlyfans? When copied into my browser they always lead to errors or either files not found or not authorized to enter. What the hell is going on?

Your file looks like a temporary browser file created by a browser from the Microsoft family.
As far as I remember the old Internet Explorer had a zone-based security concept (see entry Zone=....).
Anyway, if these files are not important for you, you can simply delete them.

It's not that the files are valuable, it that I want to know why there are browser files that lead to google photos, onlyfan, and others in with my other files. Some of which were pictures i'd rather not have floating on the internet.

Your question is beyond the scope of this forum.
I am sure that will find the answer somewhere else.