While After choosing to exit the bash session, notice that the .bash_history file has not been updated.<\/p>\n\n\n\n The same operations can be performed for The above ping operation is not saved to the .bash_history file upon exit of the bash shell as expected.<\/p>\n\n\n\n To make the changes permanent add While .bash_history is the default for storing command history in Bash, users can configure a different filename, location, or disable bash history by setting the HISTFILE environment variable.<\/p>\n","protected":false},"author":1,"featured_media":383,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[60,28,54],"class_list":["post-382","post","type-post","status-publish","format-standard","has-post-thumbnail","category-anti-forensics","tag-bash","tag-digital-forensics","tag-linux"],"yoast_head":"\n.bash_history<\/code> is the default filename for storing command history in Bash, users can configure a different filename or location by setting the HISTFILE<\/code> environment variable..bash_history<\/code> can contain sensitive information such as passwords, API keys, and other confidential data if users inadvertently execute commands containing such information.<\/p>\n\n\n\n.bash_history<\/code> can be a valuable source of forensic evidence in investigations involving system compromise or unauthorized access. Forensic analysts can analyze .bash_history<\/code> to reconstruct the sequence of events leading to a security incident.<\/p>\n\n\n\n\n
$ bash<\/code>)<\/li>\n\n\n\n$ unset HISTFILE<\/code><\/li>\n\n\n\n$ exit<\/code><\/li>\n<\/ol>\n\n\n\nuser@debian:~$ bash\r\nuser@debian:~$ unset HISTFILE\r\nuser@debian:~$ ping google.com\nuser@debian:~$ exit<\/code><\/pre>\n\n\n\nzsh<\/code>.<\/p>\n\n\n\nAnother Technique<\/h2>\n\n\n\n
user@debian:~$ bash\r\nuser@debian:~$ export HISTFILE=\/dev\/null\r\nuser@debian:~$ ping google.com\r\nuser@debian:~$ exit\r<\/code><\/pre>\n\n\n\nunset HISTFILE<\/code> or export HISTFILE=\/dev\/null<\/code> to the end of the user .bashrc configuration file.<\/p>\n","protected":false},"excerpt":{"rendered":"