Clear Zsh History

A subject clears, truncates, redirects, or suppresses Z shell (Zsh) command history to prevent executed commands from being reviewed. The subject may delete or truncate the history file, clear commands held within the current session, change or unset the HISTFILE parameter, reduce the number of commands retained through SAVEHIST, redirect history to a non-persistent location, or modify shell startup files to prevent future commands from being written.

The Zsh history file is commonly stored as .zsh_history within the subject’s home directory, although its location is determined by the configured HISTFILE parameter. Investigators should examine the presence, size, timestamps, and contents of the history file; changes to .zshrc and other shell configuration files; macOS File System Events; and process or endpoint telemetry showing commands that do not appear in the surviving history.