Accidentally truncated crontab

Daniela dgw at liwest.at
Mon Aug 9 14:37:26 PDT 2004


On Monday 09 August 2004 18:38, Bill Moran wrote:
> Daniela <dgw at liwest.at> wrote:
> > Hi all!
> >
> > I just emptied the system crontab, and don't know how I can recover it.
> > I know that the contents are still somewhere on the drive, as I didn't
> > write anything on that partition.
> > The size of the file must be stored somewhere in the inode, or maybe in
> > the directory, so I could just load the raw partition into my hexeditor
> > and change that field to the original length. But I thought I'd better
> > not touch it without consulting the experts first, because I don't have
> > much experience with file systems.
> > In the ports I couldn't find an undelete utility, and the -w option to rm
> > doesn't work here.
> >
> > Please help me, or at least tell me that there's nothing else I can do,
> > so I can use the method mentioned above.
>
> Well ... there are some undelete utilities out there (I'm surprised there
> are none in the ports) and I've seen a number of tutorials on how to
> recover deleted files from UFS filesytems ... but I think you're
> _seriously_ overcomplicating things!

It was really not as complicated as I thought. After searching the web and 
finding no undelete tools, but a tutorial on UFS layout, I pulled out the 
binary editor and recovered the file myself. It was much easier than I 
expected! Well, I had to make a copy of that file system, since it's root, so 
I can't simply unmount it. But that was pretty much the only complication.
I think that low-level stuff starts to grow on me! Maybe I should start 
writing device drivers, kernel modules and so on.

> If you haven't customized the crontab, and you have sources installed, then
> "cd /usr/src; mergemaster" will give you an opportunity to re-install the
> default system crontab.  You could also download it directly from CVS.

No, the file was heavily customized.

> If you did customize it and are foolish enough not to have backups, then
> do some google searches on "undeleting from UFS" or something like that.
> I've seen a few articles on how to do it in the past.  And start making
> backups.  Putting your /etc directory under revision control is a decent
> idea!

Yes, you're right, I was an idiot. I had a backup, but it was not recent 
enough. I'm really too lazy and irresponsible to be root. I'm young and I 
have much to learn. Revision control is great, and I'll install tripwire, 
which I should have done a long time ago.

Thanks for your answer.
Daniela



More information about the freebsd-questions mailing list