Community plugin
Shell History
Collects bash, zsh, sh, and fish shell history files and parses commands with timestamps
shell.historyCommunitymacOS 10.12+v1.0.0usercommandshellRun this plugin
Trigger collection for Shell History on its own with the --plugin flag, or include it in a wider sweep by category.
# Just this plugin
macfor collect --plugin shell.history --output ./evidence.zip
# Dry run — list what would be collected
macfor collect --plugin shell.history --dry-runCompatibility
- macOS 10.12+
Artifacts collected (4)
Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.
command history
| Artifact | Format | Path | Notes |
|---|---|---|---|
Zsh History zsh_historyOptional | text | ~/.zsh_history | — |
Bash History bash_historyOptional | text | ~/.bash_history | — |
Fish Shell History fish_historyOptional | yaml | ~/.local/share/fish/fish_history | — |
POSIX Shell History sh_historyOptional | text | ~/.sh_history | — |