Area 03

User Activity

Home directories hold a surprising amount of evidence. This area covers bash, zsh and fish history formats, signs of history evasion, SSH known_hosts and authorized_keys, application histories such as .viminfo and .lesshst, and account changes in /etc/passwd and /etc/shadow.

~/.bash_history
~/.ssh/
~/.viminfo

Guides in this area

03 · User Activity

Linux Shell History and User Activity Forensics

Reconstruct what a user did on a Linux host from bash, zsh and fish history, dotfiles, SSH files, sudo logs and account databases, and spot history evasion.

shell-historybashuser-activity

Sep 28, 2026

Artifact cheat sheets

Where each artifact lives, what it proves, its timestamps and the tools to parse it.

Shell History: Linux bash, zsh and fish Command LogsPer-user command history written by bash, zsh and fish on Linux: what each file records, when timestamps exist and how history evasion shows up.
SSH Artifacts: authorized_keys, known_hosts and sshd LogsOpenSSH artifacts on Linux (authorized_keys, known_hosts, configs, host keys, sshd logs) that prove remote access, key persistence and lateral movement.
viminfo, ShaDa and lesshst: Linux Editor and Pager HistoryVim viminfo, Neovim ShaDa and less history files on Linux: which files a user edited, what they searched for and typed, often after shell history is wiped.
/etc/passwd, shadow and group: Linux Local AccountsLinux local account databases (passwd, shadow, group, gshadow and their backups) that reveal rogue accounts, UID 0 clones and password change dates.
sudo Logs: Linux Privilege Use RecordsHow sudo records who ran what as root on Linux: syslog and journal lines, optional log files and I/O session recordings, plus sudoers policy files.
recently-used.xbel: GNOME and GTK Recent Files on LinuxThe freedesktop recently-used.xbel file on Linux desktops: which files and URIs a user opened through GTK (and newer KDE) applications, with UTC times.
Tracker / LocalSearch DB: GNOME File Index on LinuxGNOME's Tracker and LocalSearch file index on Linux: SQLite databases listing indexed files, their timestamps and extracted content for a user's home.
Browser Profiles on Linux: Firefox and Chrome HistoryFirefox and Chrome/Chromium profile databases on Linux, including snap and Flatpak paths: history, downloads, epochs and how to query them offline.
udev and USB Device History on LinuxReconstruct USB device connections on Linux from kernel, udisks and USBGuard logs, and check udev rules used for RUN+= persistence.
Linux Trash: freedesktop .trashinfo Files and Deleted ItemsThe freedesktop.org Trash on Linux desktops: .trashinfo records with original path and deletion time, the trashed files themselves and per-volume trash folders.
Linux Thumbnail Cache: ~/.cache/thumbnails ForensicsThe freedesktop thumbnail cache on Linux: PNG previews named by the MD5 of the file URI, holding path and mtime, that outlive deleted files.
Snap and Flatpak Artifacts: Linux Sandboxed App ForensicsSnap and Flatpak evidence on Linux: snapd state.json change history, sideloaded snaps, Flatpak installations and remotes, and per-app data directories.

All areas