> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/file-download.md).

# File Download

- [Zone.Identifier](https://windows.dfirhandbook.com/windows-artifacts/file-download/zone.identifier.md)
- [Open/Save Most Recently Used (MRU)](https://windows.dfirhandbook.com/windows-artifacts/file-download/open-save-most-recently-used-mru.md)
- [Email](https://windows.dfirhandbook.com/windows-artifacts/file-download/email.md)
- [Drive By Downloads](https://windows.dfirhandbook.com/windows-artifacts/file-download/drive-by-downloads.md)
- [Malvertising](https://windows.dfirhandbook.com/windows-artifacts/file-download/drive-by-downloads/malvertising.md)
- [Web Browsing](https://windows.dfirhandbook.com/windows-artifacts/file-download/web-browsing.md): Some MacOS included in here as well
- [Cache Files](https://windows.dfirhandbook.com/windows-artifacts/file-download/web-browsing/cache-files.md)
- [CrowdStrike Searches](https://windows.dfirhandbook.com/windows-artifacts/file-download/crowdstrike-searches.md)
- [MoTW](https://windows.dfirhandbook.com/windows-artifacts/file-download/crowdstrike-searches/motw.md)