13

I was trying to edit crontab in the terminal, and I accidentally typed crontab -r instead of crontab -e. Who would figure such dangerous command would sit right next to the letter to edit the crontab? Moreover, I am still trying to figure out how does crontab -r not ask you for confirmation?

Regardless of my lack of credibility as to how this is possible, my question is: am I able to recover the lost crontab?

7
  • Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation. Dec 1, 2017 at 9:33
  • @RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)... Dec 1, 2017 at 9:49
  • 1
    Stuff like this is one reason why I use etckeeper. Dec 1, 2017 at 11:44
  • 2
    Restore it from backup
    – PiedPiper
    Dec 1, 2017 at 12:24
  • @PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab. Dec 1, 2017 at 12:27

3 Answers 3

8

You can find your cron jobs from the log if once it has executed before. Check /var/log/cron.

You do not have any recovery option other than third party recovery tools.

6
  • Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running? Dec 1, 2017 at 9:53
  • I think you have to go line by line for last one month. Sorry Dec 1, 2017 at 11:29
  • No need for "line by line". Use grep with either -o or piped into sed/awk/cut/etc to extract just the command, and then piped into sort -u.
    – phemmer
    Dec 1, 2017 at 13:31
  • 3
    You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something like awk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8 will show the entries for username sorted by command, which should make it easier to see the intervals between them so you can recreate their schedules. Dec 1, 2017 at 14:28
  • @JamesSneeringer that is definitely witchcraft! thumbs up for that! Dec 1, 2017 at 15:42
3

If you remember a specific line, you can grep the whole device to find your data back, at the condition that no other data overwrote it. This works for any file.

grep -a -B100 -A100 "command/you remember" /dev/sda1 > /tmp/cron.ressurected

Adjust -B(efore) and -A(fter) to your file size, but 100 lines around should be enough for a cron file. The -a parameter is needed to force grep to consider your device as text.

You will then have to clean the binary mess before and after your data in the resulting file.

And it takes a lot of time. Good luck.

You could also refer to this answer : Undelete / recover deleted files | Unix & Linux Stack Exchange

2

I am not sure, it is possible to recover crontab file without backup. But, I am pretty sure you can restore your crontab file from cron logs. As far as I remember, fast every command is listed there with user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.