When Word, Excel, or PowerPoint opens the file and sees this marker it knows to open the file within Protected View and the user sees the red bar. The application knows this because Windows uses the Attachment Execution Service to place a zone identifier in an alternate data stream of the file which indicates it was downloaded from the Internet Zone. When a document that was previously attached to an email (or downloaded from the Internet) is opened, the red message bar states 'This file originated as an email attachment ' or 'This file was downloaded from the Internet'.
