Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do I search for a sequence of bytes (FEEDFEED00000002) in hex code and display 1000 bytes after this sequence?

It's the beginning of a lost file I am looking for on a Linux partition. This command outputs harddrive contents in hex code:

sudo cat /dev/sda1 | hexdump -v -e '"" 1/1 "%02X" ""'
# output is FF45D5003E... etc

I need to search for FEEDFEED00000002 in the output.

share|improve this question

1 Answer 1

grep can search for binary patterns, it may be more efficient than examining the output of hexdump, which will be roughly 3 times larger:

grep -b `echo -e "\xFE\xED\xFE\xED.."` /dev/sda1 | cut -d: -f1 >offsets

Will give you the byte offsets; then you could extract 1k blocks with

for o in `cat offsets`
do
    dd if=/dev/sda1 of=block.{$o} bs=1 count=1000 skip=$o
done

Which will create one file per matching offset. You can always run hexdump on these afterwards.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.