Shell history

The commands a user typed, in order, in a plain text file they own and can edit. Enormously useful and never, on its own, evidence of anything.

linux · Execution · T1059.004

where it lives

~/.bash_history

bash

Written when the shell exits, not as you type, unless histappend and PROMPT_COMMAND are set.

~/.zsh_history

zsh

Carries timestamps when EXTENDED_HISTORY is set, which bash does not by default.

what it proves

What was typed interactively, in order
Frequently, the attacker's own working notes: typos, retries and the path they were reaching for

what it does not prove

When. bash writes no timestamps unless HISTTIMEFORMAT is set, so ordering is all you have
That the user ran it. The file is owned and writable by them, so it can be edited or replaced
Anything about a session that set HISTFILE=/dev/null, ran sh instead of bash, or was killed rather than exited

parsing it

cat
grep

tampering and anti-forensics

Trivially cleared, and often is. An empty history on an account that demonstrably ran commands is a finding in itself. Corroborate with auditd or process accounting before relying on any of it.

how long it survives