PSReadLine history

Location & availability

HistorySavePath from PSReadLine settings; commonly a per-user ConsoleHost_history.txt

The host, module settings, save style and filtering affect retention. Noninteractive scripts may not appear.

Fields to examine

• Retained command text and ordering.
• The profile, host and configured history path.
• File metadata, distinguished from individual command times.

What it can establish

• Support that particular command text was retained in the examined history file.

What it cannot prove

• Prove command success or exact timing from line order alone.
• Infer no script ran because the history file is empty.

Use it in a screenshare

1. Identify the relevant PowerShell host and history path without submitting suspect commands. Preserve a copy.
2. Review only the scoped lines; command histories can contain unrelated private information. Never execute history text as part of parsing.
3. Correlate selected commands with script-block events, process creation and relevant output files. Keep missing output as an unresolved gap.

Worked example

History contains a download command but no result. A matching browser or filesystem record may confirm a resulting file. Without such evidence, distinguish retained command text from a proven successful download.

Cross-check the finding

• PowerShell script-block logs →Support that the engine logged the recorded script-block content.
• Security event 4688 →Support process creation recorded by the audited host.
• USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.

Sources

• Microsoft — PSReadLine history settings ↗