Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I search for a sequence of bytes (FEEDFEED00000002) in hex code and display 1000 bytes after this sequence?

It's the beginning of a lost file I am looking for on a Linux partition. This command outputs harddrive contents in hex code:

sudo cat /dev/sda1 | hexdump -v -e '"" 1/1 "%02X" ""'
# output is FF45D5003E... etc

I need to search for FEEDFEED00000002 in the output.

share|improve this question

grep can search for binary patterns, it may be more efficient than examining the output of hexdump, which will be roughly 3 times larger:

grep -b `echo -e "\xFE\xED\xFE\xED.."` /dev/sda1 | cut -d: -f1 >offsets

Will give you the byte offsets; then you could extract 1k blocks with

for o in `cat offsets`
    dd if=/dev/sda1 of=block.{$o} bs=1 count=1000 skip=$o

Which will create one file per matching offset. You can always run hexdump on these afterwards.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.