IIS Authorization and Restrictions - asp.net

Question

I'm trying to restrict anonymous users from browsing directly to a particular filename (image file) in a folder on my website. But when I turn on the "IIS Authentication" feature on the folder, both anonymous users and the website application can't access the image file.
How can I deny access to the file for anonymous users (for example, if the user were to type in the absolute url), but allow access to the website application? (I thought that maybe the "IP Address and Domain Restrictions" feature could be used, as well, but couldn't get it to work)
I could move the image file to a folder outside of the website, but then not sure how to use it in the .ImageUrl property.
...bump
EDIT - Solution (put following in a .aspx page and set the ImageUrl property to this page, with any needed querystring parameters):
Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
If (Request.QueryString("FileType") IsNot Nothing) And (Request.QueryString("FileName") IsNot Nothing) Then
Try
' Read the file and convert it to Byte Array
Dim filePath As String = UrlXlat(Request.QueryString("FileType") & "\")
Dim fileName As String = Request.QueryString("FileName")
Dim contentType As String = "image/" & Path.GetExtension(fileName).Replace(".", "")
Dim fs As FileStream = New FileStream(filePath & fileName, FileMode.Open, FileAccess.Read)
Dim br As BinaryReader = New BinaryReader(fs)
Dim bytes As Byte() = br.ReadBytes(Convert.ToInt32(fs.Length))
br.Close()
fs.Close()
'Write the file to Reponse
Response.Buffer = True
Response.Charset = ""
Response.Cache.SetCacheability(HttpCacheability.NoCache)
Response.ContentType = contentType
Response.AddHeader("content-disposition", "attachment;filename=" & fileName)
Response.BinaryWrite(bytes)
Response.Flush()
Response.End()
Catch ex As Exception
response.write(ex):response.end
End Try
End If
End Sub

Answer 1

You can move the file either to a folder outside of the root of the site or to the App_Data folder (which is protected form direct browsing by the ASP.NET framework) and then set your ImageUrl to point to a generic handler (.ashx file) which will be responsible for delivering the file to the browser. You perform your authentication checks in the handler.
I've written an article that provides implementation details: http://www.mikesdotnetting.com/article/122/simple-file-download-protection-with-asp-net