A forensic examiner is reviewing a laptop running OS X which has been compromised. The examiner wants to know if any shell commands were executed by…

On UNIX-based operating systems like macOS (formerly OS X), the Bash shell was the default for many versions. The .bashhistory file, located in a user's home directory (/Users//), is the standard file used by the Bash shell to log the commands executed by that user in the terminal. Forensic examiners review this file to reconstruct a user's command-line activity. While newer macOS versions default to Z shell (.zshhistory), .bashhistory remains a critical artifact to check for user activity.

A. /var/vm: This directory is used by the operating system to store virtual memory swap and sleep image files, not user command history.

C. /var/log: This directory contains system-level log files for services and the operating system itself, not a history of interactive shell commands for a specific user.

D. /Users//Library/Preferences: This location stores user-specific application settings and configuration files, typically in .plist format, not shell command history.

1. GNU Bash Manual: The official documentation for the Bash shell specifies the function and default location of the history file. In the "HISTORY" section, it states, "The file named by the value of the HISTFILE variable is used to store the command history. The default value is ~/.bashhistory."

Source: GNU Bash Manual, Section 6.1 "Bash History Facilities". (Accessible via the man bash command on any UNIX-like system).

2. University Courseware (SANS Institute): The SANS Institute, a reputable source for cybersecurity training and research, identifies this file as a key artifact in macOS forensics.

Source: SANS Institute, FOR518: Mac and iOS Forensic Analysis and Incident Response course materials. The "Mac Forensics Poster" explicitly lists ~/.bashhistory and ~/.zshhistory under "User Activity" artifacts.

3. Peer-Reviewed Academic Publication/Textbook: Foundational digital forensics textbooks confirm the role of shell history files in investigations.

Source: Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Chapter 13, "Unix and Linux Analysis," discusses the analysis of user activity, which includes examining shell history files like .bashhistory to determine commands executed by a user.