How to recover deleted crontab

Question

I was trying to edit crontab in the terminal, and I accidentally typed crontab -r instead of crontab -e. Who would figure such dangerous command would sit right next to the letter to edit the crontab? Moreover, I am still trying to figure out how does crontab -r not ask you for confirmation?

Regardless of my lack of credibility as to how this is possible, my question is: am I able to recover the lost crontab?

Just for information, crontab -r will remove crontab without prompting and crontab -i will ask for confirmation. — Raman Sailopal, Dec 01 '17 at 09:33
@RamanSailopal thank you for the information. that really is dangerous, given the fact that -e and -r are next to each other (at least on qwerty)... — Miguel Mesquita Alfaiate, Dec 01 '17 at 09:49
@PiedPiper if I had that on backup, this would not be an issue. I have home folders being backed up, but not this root crontab. — Miguel Mesquita Alfaiate, Dec 01 '17 at 12:27
@DavidFoerster You do realize the user crontabs are not in /etc/, but rather someplace like /var/spool/cron/crontabs/? ;) — marcelm, Dec 01 '17 at 13:48
@marcelm: I'm aware. My suggestion addresses /etc/crontab specifically, though there's no reason (aside of invested effort) to not put /var/spool/cron/crontabs or its children under revision control. — David Foerster, Dec 01 '17 at 14:04

score 8 · Accepted Answer · edited Dec 01 '17 at 11:55

8

You can find your cron jobs from the log if once it has executed before. Check /var/log/cron.

You do not have any recovery option other than third party recovery tools.

edited Dec 01 '17 at 11:55

David Foerster

1,575

answered Dec 01 '17 at 09:29

Muhammed Sherief

106

Any hints on how I can check I am not missing something? What if there was some weekly, or monthly task? Would I have to go line by line until the beginning of last month to find out if I have some less common cronjob running? – Miguel Mesquita Alfaiate Dec 01 '17 at 09:53
I think you have to go line by line for last one month. Sorry – Muhammed Sherief Dec 01 '17 at 11:29
No need for "line by line". Use grep with either -o or piped into sed/awk/cut/etc to extract just the command, and then piped into sort -u. – phemmer Dec 01 '17 at 13:31
3

You'll still need to go line-by-line to work out the schedules if they aren't simply daily or weekly. Something like awk '$5 ~ "^CROND" && $6 == "(username)" { print }' /var/log/cron | sort -t ' ' -k 8 will show the entries for username sorted by command, which should make it easier to see the intervals between them so you can recreate their schedules. – James Sneeringer Dec 01 '17 at 14:28
@JamesSneeringer that is definitely witchcraft! thumbs up for that! – Miguel Mesquita Alfaiate Dec 01 '17 at 15:42
@BlunT - Thanks! I can't edit my comment (too late), but in hindsight, the -t ' ' is not needed and should be removed from the sort command, otherwise it could behave unexpectedly for days of the month 1-9 (since there are 2 spaces in the timestamp in those cases). – James Sneeringer Dec 01 '17 at 15:46

score 3 · Answer 2 · edited Mar 04 '18 at 10:24

If you remember a specific line, you can grep the whole device to find your data back, at the condition that no other data overwrote it. This works for any file.

grep -a -B100 -A100 "command/you remember" /dev/sda1 > /tmp/cron.ressurected

Adjust -B(efore) and -A(fter) to your file size, but 100 lines around should be enough for a cron file. The -a parameter is needed to force grep to consider your device as text.

You will then have to clean the binary mess before and after your data in the resulting file.

And it takes a lot of time. Good luck.

You could also refer to this answer : Undelete / recover deleted files | Unix & Linux Stack Exchange

score 2 · Answer 3 · answered Dec 01 '17 at 09:28

I am not sure, it is possible to recover crontab file without backup. But, I am pretty sure you can restore your crontab file from cron logs. As far as I remember, fast every command is listed there with user.

How to recover deleted crontab

3 Answers3