Shell history
The commands a user typed, in order, in a plain text file they own and can edit. Enormously useful and never, on its own, evidence of anything.
where it lives
~/.bash_historyWritten when the shell exits, not as you type, unless histappend and PROMPT_COMMAND are set.
~/.zsh_historyCarries timestamps when EXTENDED_HISTORY is set, which bash does not by default.
what it proves
- What was typed interactively, in order
- Frequently, the attacker's own working notes: typos, retries and the path they were reaching for
what it does not prove
- When. bash writes no timestamps unless HISTTIMEFORMAT is set, so ordering is all you have
- That the user ran it. The file is owned and writable by them, so it can be edited or replaced
- Anything about a session that set HISTFILE=/dev/null, ran sh instead of bash, or was killed rather than exited
parsing it
catgrep
tampering and anti-forensics
Trivially cleared, and often is. An empty history on an account that demonstrably ran commands is a finding in itself. Corroborate with auditd or process accounting before relying on any of it.
how long it survives
Until the user clears it, capped at HISTFILESIZE.