Month of @volatility plugins teaser: Recovering .bash_history from memory, even in the face of anti-forensics: pastebin.com/Pj39TMrU #dfir

@attrc Does it only work if history timestamps are enabled?

@hal_pomeranz nope, that's the awesome part, bash keeps them anyway

@attrc Ah, I gotcha-- identifying the bash processes and sucking the history out?

@hal_pomeranz yep using the structures in mem so u get time run and command together