Why `cmd /k` and `cmd /c` remember the history of already finished cmd sub-processes?

Question

Here're the command I've executed:

>cmd /k
>echo 1
1

>echo 2
2

>echo 3
3

>exit /b

>cmd /c "doskey /history"
echo 1
echo 2
echo 3
exit /b

>

(tested on windows 7x64) According tho the process explorer the cmd /k starts a sub-process (not a thread). So after process is exited I would expect that it will clear his things from the memory. This thing happens on 3/4/.. spawned cmds , for /f , with called batch file.

Answer 1

Short version:

The console window handles the command history

Detailed:

The processes of a command prompt window is as follows:

conhost.exe
--- doskey.exe
------ cmd.exe
--------- any sub-processes (In your case cmd /k)

As on Microsoft technet:

... If you exit and then restart a program from the same Command Prompt window, the command history from the previous program session is available.

You must run Doskey.exe before you start a program. You cannot use doskey command-line options from a program's command prompt, even if the program has a shell command.

Doskey is executed under conhost.exe, the process that displays the command prompt window. This enables it to monitor keystrokes for all sub-processes and threads.

When you call cmd from within another process, the root CMD process handles the doskey history

Update:

As commented by MC ND, in Windows XP/2003/Vista/2008 the command history is handled by csrss.exe. From Windows 7 upwards, conhost.exe handles the command history - more here