I say that with one caveat though. Shell history is pulled from a users .history or .bash_history files