To also give a screen-related answer: You can enable logging in screen. This gives you a complete transcript file for each session in a separate file. That should help also to diagnose what happened right before a screen sesison was killed, and such. (But when there was no logging, and shell history got lost, you have very little chance of diagnosing a crash that already happened. - Maybe some sudo or ssh commands leave traces in the syslog, but most commands don't )
cheers, JW-
