Domaine 03

Activité utilisateur

Les répertoires personnels contiennent une quantité surprenante de preuves. Ce domaine couvre les formats d'historique bash, zsh et fish, les signes d'évasion de l'historique, known_hosts et authorized_keys, les historiques applicatifs comme .viminfo et .lesshst, et les changements de comptes dans /etc/passwd et /etc/shadow.

~/.bash_history
~/.ssh/
~/.viminfo

Guides de ce domaine

Ces guides sont pour l'instant publiés en anglais uniquement. Les liens ci-dessous ouvrent la version anglaise.

03 · Activité utilisateurAnglais

Linux Shell History and User Activity Forensics

Reconstruct what a user did on a Linux host from bash, zsh and fish history, dotfiles, SSH files, sudo logs and account databases, and spot history evasion.

shell-historybashuser-activity

28 sept. 2026

Fiches artefacts

Emplacement de chaque artefact, ce qu'il prouve, ses horodatages et les outils pour l'analyser.

Historique du shell : commandes bash, zsh et fishHistorique des commandes par utilisateur de bash, zsh et fish : contenu de chaque fichier, présence des horodatages et traces d'évasion de l'historique.
Artefacts SSH : authorized_keys, known_hosts, logs sshdArtefacts OpenSSH sous Linux (authorized_keys, known_hosts, configuration, clés d'hôte, logs sshd) : accès distant, persistance par clé et mouvement latéral.
viminfo, ShaDa and lesshst: Linux Editor and Pager HistoryVim viminfo, Neovim ShaDa and less history files on Linux: which files a user edited, what they searched for and typed, often after shell history is wiped.
/etc/passwd, shadow and group: Linux Local AccountsLinux local account databases (passwd, shadow, group, gshadow and their backups) that reveal rogue accounts, UID 0 clones and password change dates.
Journaux sudo : traces d'usage de privilèges LinuxComment sudo enregistre qui a exécuté quoi en root sous Linux : lignes syslog et journal, fichier de log optionnel, sessions enregistrées et règles sudoers.
recently-used.xbel: GNOME and GTK Recent Files on LinuxThe freedesktop recently-used.xbel file on Linux desktops: which files and URIs a user opened through GTK (and newer KDE) applications, with UTC times.
Tracker / LocalSearch DB: GNOME File Index on LinuxGNOME's Tracker and LocalSearch file index on Linux: SQLite databases listing indexed files, their timestamps and extracted content for a user's home.
Browser Profiles on Linux: Firefox and Chrome HistoryFirefox and Chrome/Chromium profile databases on Linux, including snap and Flatpak paths: history, downloads, epochs and how to query them offline.
udev and USB Device History on LinuxReconstruct USB device connections on Linux from kernel, udisks and USBGuard logs, and check udev rules used for RUN+= persistence.
Linux Trash: freedesktop .trashinfo Files and Deleted ItemsThe freedesktop.org Trash on Linux desktops: .trashinfo records with original path and deletion time, the trashed files themselves and per-volume trash folders.
Linux Thumbnail Cache: ~/.cache/thumbnails ForensicsThe freedesktop thumbnail cache on Linux: PNG previews named by the MD5 of the file URI, holding path and mtime, that outlive deleted files.
Snap and Flatpak Artifacts: Linux Sandboxed App ForensicsSnap and Flatpak evidence on Linux: snapd state.json change history, sideloaded snaps, Flatpak installations and remotes, and per-app data directories.

Tous les domaines