DFIRHub

OpenAICodex

OpenAI Codex CLI (agentic coding CLI) session rollouts, prompt history, state databases, and configuration

  • Apps
  • 19 paths
  • Per-user data
  • Version 1
  • Eric Capuano

Paths on disk

19 paths

Paths use Windows environment variable syntax

Notes

Codex stores all state under CODEX_HOME, which defaults to %USERPROFILE%\.codex\ (C:\Users\<user>\.codex\) on Windows.

If the CODEX_HOME environment variable is set (it may be a comma-separated list), check those directories instead.

Primary evidence of use is sessions\YYYY\MM\DD\rollout-<ISO timestamp>-<uuid>.jsonl. Each line has timestamp, type

(session_meta, response_item, event_msg, turn_context, compacted) and payload. session_meta records cwd, cli_version,

originator (codex_cli_rs, vscode, codex_desktop, etc), model, and git metadata. response_item function_call entries

contain the exact shell commands executed and function_call_output their results.

history.jsonl provides a quick cross-session timeline of prompts.

Project-level AGENTS.md files and .codex\ folders inside repositories are not collected because their locations are

arbitrary; the projects table in state_*.sqlite and the cwd values in session_meta identify which directories to examine.

Deliberately not collected: .codex\auth.json (API key / OAuth tokens), .codex\cache\ and .codex\plugins\ (large, reproducible),

.codex\tmp\ and .codex\computer-use\ (transient).

Layout verified against Codex CLI on macOS; the relative layout under CODEX_HOME is the same on Windows.

References

5 links