If someone were to delete commands from the shells history, is there any way to recover those deleted commands in Linux?
$disk being the disk or partition that contained the history file, and
$cmd being a very distinct part of a command that you remember being in said history, and
100 being the number of commands that were in your history in total, then maybe
strings -w "$disk" | grep -C 100 "$cmd"
would find some fragments of it. The condition would be that the history file was deleted or truncated, but not overwritten in place or TRIM/discarded.
strings extracts all human-readable strings from a raw device.
grep searches them and with the
-C option also provides lines of context.
If you're looking for histories from other people, so you don't know any command after all... then maybe you could grep for
^cd \.\.$. It's a command that appears in most histories (at least, if the user is navigating directories at all). At the same time it's only rarely used in scripts.