iTerm2

Overview

iTerm2 is the dominant third-party terminal emulator on macOS, and its Shell Integration feature makes it a high-value forensic artifact. When shell integration is enabled, iTerm2 records a per-command history — including the working directory and remote host — to plain JSON files under ~/.iterm2/. This history is written independently of the shell's own history file, so it frequently preserves commands that never reached .zsh_history (private sessions, cleared histories, or shells with history disabled). Profiles stored in the preferences plist expose configured SSH targets and trigger rules, while saved state and automation scripts round out a detailed picture of how the terminal was used.

What Each Source Yields

• Command History (CommandHistory.json) — The forensic centerpiece: each command with the directory it was run in, its last-use time (Unix epoch), how many times it was run, and the hostname and username where captured. Often the only surviving record of activity in a session.
• Directory History (DirectoryHistory.json) — Directories the user navigated to, with timestamps and visit frequency, revealing which paths and projects were active.
• Remote Hosts (RemoteHosts.json) — Hostnames and usernames observed during shell-integrated SSH sessions, mapping lateral movement and remote access targets.
• Profiles & SSH configuration (com.googlecode.iterm2.plist) — The New Bookmarks array holds each profile, including custom SSH commands, hostnames, and triggers. Dynamically loaded profiles under DynamicProfiles/ are collected alongside.
• Saved State (SavedState/) — Window and tab restoration data that can preserve on-screen text and open session context; opaque binary, extracted best-effort.
• Automation Scripts (Scripts/) — Python scripts the user installed to automate the terminal. Metadata (names, paths, timestamps) is always collected; script contents are opt-in.

Analysis Tips

• Cross-reference with shell history: Commands present in CommandHistory.json but absent from .zsh_history are a strong signal of anti-forensic behavior or private sessions.
• Map SSH activity: Combine RemoteHosts.json with the SSH commands embedded in profiles to reconstruct which remote systems were accessed and how.
• Timeline reconstruction: The Unix-epoch timestamps in command and directory history align cleanly with FSEvents, Unified Logs, and Quarantine timelines.
• Inspect triggers: Profile triggers can execute actions on matched output — review them for automation that may have been abused.
• Review saved state: Restored windows can retain fragments of prior on-screen content even after the shell history is gone.

Related Artifacts

• Shell History - Compare against .zsh_history to surface commands recorded only by iTerm2
• Unified Logs - Correlate command execution with process launch events
• FSEvents - Match directory history and file operations to filesystem activity

References

• iTerm2 Shell Integration
• iTerm2 Dynamic Profiles