Community plugin
Shell History
Collects bash, zsh, sh, and fish shell history files and parses commands with timestamps
shell.historyCommunitymacOS 10.12+v1.0.0usercommandshellRun this plugin
Trigger collection for Shell History on its own with the --plugin flag, or include it in a wider sweep by category.
# Just this plugin
macfor collect --plugin shell.history --output ./evidence.zip
# Dry run — list what would be collected
macfor collect --plugin shell.history --dry-runCompatibility
- macOS 10.12+
Artifacts (4 collected)
Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.
command history
| Artifact | Format | Path | Notes |
|---|---|---|---|
Zsh History zsh_historyOptional | text | ~/.zsh_history | — |
Bash History bash_historyOptional | text | ~/.bash_history | — |
Fish Shell History fish_historyOptional | yaml | ~/.local/share/fish/fish_history | — |
POSIX Shell History sh_historyOptional | text | ~/.sh_history | — |