iTerm2

Overview

iTerm2 is the dominant third-party terminal emulator on macOS and is nearly ubiquitous on developer and system-administrator workstations. Because those workstations are frequently the focus of insider-threat, data-exfiltration, and intrusion investigations, iTerm2's artifacts are routinely relevant to macOS forensics.

iTerm2's most forensically significant feature is Shell Integration. When enabled, iTerm2 records the commands a user runs, the directories they visit, and the remote hosts they connect to, writing them to plaintext JSON files under ~/.iterm2/. Because these files live outside the standard shell-history locations, they frequently survive anti-forensic clearing of ~/.zsh_history or ~/.bash_history — an investigator may recover a command from iTerm2's history that the user believed they had deleted.

Beyond Shell Integration, iTerm2 stores a rich configuration in its preferences plist: named profiles that often embed SSH hostnames, ports, usernames, and key paths; trigger rules that fire actions on matching terminal output; saved session state that can retain terminal buffer contents after a session ends; and Python automation scripts that reveal user workflows. The macfor plugin identifier is devtools.iterm2.

Forensic Significance

Why iTerm2 Matters Forensically

macOS shell-history collection (bash, zsh, fish) captures commands the shell recorded. iTerm2 Shell Integration captures commands the terminal recorded, from a different subsystem and to different files. The two are complementary:

• A user who runs rm ~/.zsh_history or history -c clears the shell's record but not ~/.iterm2/CommandHistory.json.
• iTerm2 associates each command with the remote host it ran on, so commands executed over SSH inside an iTerm2 session are attributed to the correct machine — context that a bare .bash_history on the local disk does not provide.
• iTerm2 records a use count and a last-used timestamp per command and per directory, supporting frequency analysis.

Artifact Locations

All per-user paths are relative to each user's home directory. macfor enumerates every local user account and checks each location for each user, so a multi-user system yields per-user artifact sets.

Categories

• Command History — Shell Integration command, directory, and remote-host histories from ~/.iterm2/
• Profiles & SSH Configuration — Named profiles, embedded SSH connection details, dynamic profiles, and trigger rules from the preferences plist
• Saved State — Window and session restoration files that may retain terminal buffer content
• Automation Scripts — Python API scripts under Scripts/ that reveal user workflows

Detection

iTerm2 is present if any of the following exist:

• The application bundle at /Applications/iTerm.app or ~/Applications/iTerm.app (version read from CFBundleShortVersionString in the bundle Info.plist).
• The preferences plist ~/Library/Preferences/com.googlecode.iterm2.plist.
• The Shell Integration directory ~/.iterm2/ or a ~/.iterm2_shell_integration.* loader script (indicates Shell Integration is enabled).
• The Application Support directory ~/Library/Application Support/iTerm2/.

The presence of ~/.iterm2/ or a loader script is the signal that command/directory/host histories should be available. Their absence means Shell Integration was never enabled — all other artifact groups are still collected.

Timestamps

Shell Integration history files store timestamps as Unix epoch values (seconds since 1970-01-01 00:00:00 UTC), stored as floating-point numbers that may carry a fractional component. macfor converts them to RFC 3339 UTC strings in its output. File-system metadata timestamps (saved-state and script modification and creation times) come from the on-disk stat/birth-time values.

Tool Support

References

• iTerm2 Shell Integration Documentation
• iTerm2 Dynamic Profiles Documentation
• iTerm2 Python API / Scripting
• MITRE ATT&CK — Clear Command History (T1070.003)