> For the complete documentation index, see [llms.txt](https://docs.particle42.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.particle42.com/windows/enumeration/powershell-history.md).

# Powershell History

A lot of information can be gathered from the series of commands that were executed on a system. By default Windows Powershell history is limited, however enterprises enable this feature to log more information to analyse systems for threats. There are 2 types of logging mechanisms - Powershell Transcription and Powershell Script Block Logging. 

Transcription - The information is stored in transcript files that are often stored in the user's home directory or even in a centralized directory for all users. 

Script Block Logging - It records commands and blocks of script code as events while executing. This is more detailed logging as the code is also recorded. 

Here are some of the commands that can be used to gather info on past commands,

```
Get-History
```

Though the history can be cleared using the 'Clear-History' command, the commands recorded in 'PSReadline' is not erased. It can be retrieved using the following command,

```
#The storage path of the file can be retrieved using the following command,
(Get-PSReadlineOption).HistorySavePath
```

The file can be read using the 'type' command.