Python History File

A .python_history file is automatically created by the Python interactive shell (REPL) to persist the command history from interactive sessions. This file records all commands typed directly into Python via the REPL, providing an artifact of potentially exploratory or preparatory scripting behavior by a subject. The presence of this file may indicate the subject used Python directly from the shell, either for experimentation, access testing, or scripting not tracked via standard IDE telemetry.

On Unix/macOS: ~/.python_history

On Windows: C:\Users\<username>\.python_history

However, this artifact is only generated if Python is invoked through a REPL session (e.g., by typing python or python3 in a terminal or using the Python application on Windows). It is not created when Python scripts are run directly from command-line interfaces like Bash or PowerShell, or through IDEs. Additionally, the location of this file may be changed, or its creation suppressed, through the use of the PYTHONHISTORY environment variable, which may indicate anti-forensics intent.