01Location
- ~/.bash_history (bash default HISTFILE)
- $HISTFILE (zsh: no history file is written if HISTFILE is unset)
02Questions it answers
- Which commands did a user run in interactive shells?
- When was a command started and how long did it run (zsh EXTENDED_HISTORY)?
- Were tools downloaded, files staged or logs cleared from the command line?
03Format and versions
| Format | Plain text, one command per line. bash: optional timestamp lines '#<seconds since epoch>' before each command. zsh EXTENDED_HISTORY: ': <beginning time>:<elapsed seconds>;<command>'. |
|---|---|
| Applies to | Behaviour as documented in the current GNU Bash and zsh manuals; defaults may be changed by distribution or user start-up files. |
04Key fields
| Field | What it tells you |
|---|---|
| Command line | The command as entered, after history expansion. |
| #<digits> (bash) | Timestamp line for the following entry, written when HISTTIMEFORMAT is set. |
| : <beginning time>:<elapsed seconds>; (zsh) | Start time in seconds since the epoch and duration in seconds. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| bash '#' line | Unix seconds (decimal text) | Present only if HISTTIMEFORMAT was set when the history was written. |
| zsh beginning time | Unix seconds (decimal text) | Present only with EXTENDED_HISTORY (or SHARE_HISTORY, which writes the same format). |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect history files for every account, including root, and the shell start-up files that set HISTFILE, HISTCONTROL and history options.
- Identify the shell and the active options to know whether lines carry timestamps.
- Convert timestamp lines to UTC and keep the original order of lines.
- Corroborate commands with the journal, authentication logs and file system times.
07Interpretation pitfalls
- bash writes history when the shell exits and overwrites the file unless histappend is set; a killed shell may leave no entry.
- HISTCONTROL=ignorespace (bash) and HIST_IGNORE_SPACE (zsh) drop commands that begin with a space.
- Files are truncated to HISTFILESIZE/SAVEHIST and are easy for a user to edit or delete.
- Without timestamp lines, line order is the only ordering and multiple sessions can interleave.
09Sources
- Bash Reference Manual — Bash History Facilities GNU Project · checked 2026-10-14
- Bash Reference Manual — Bash Variables GNU Project · checked 2026-10-14
- Why do bash history files save timestamps in Unix (Epoch) time? Red Hat Customer Portal · checked 2026-10-14
- zsh manual — Options (History) zsh project · checked 2026-10-14
- zsh manual — Parameters Used By The Shell zsh project · checked 2026-10-14