I'm sure most know this but if anyone thinks this is a way of doing forensics, keep in mind it can be easily skipped over by doing a non-standard logout, like "kill -9 $$" or if a remote ssh connection gets cut for whatever reason. The command history for a session won't get written until logout by default. A workaround such as forcing each entry to be written to a log file will have to be done to have better assurance of true history.