Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to hexdump some bytes near the end of a 1 TB hard disk drive. First, let's look near the beginning, 0x1000:

%  hexdump -n 16  -s 0x1000 -C /dev/sda2

00001000  08 70 b5 7c 20 4c 56 4d  32 20 78 5b 35 41 25 72  |.p.| LVM2 x[5A%r|

And confirming with hexedit, we see hexdump worked fine:

00001000   08 70 B5 7C  20 4C 56 4D  32 20 78 5B  35 41 25 72

Now the problem. hexedit shows near the end, at offset 0xE864544000:

64544000   FC 4E 2B A9  01 00 00 00  00 00 00 00  00 00 00 00

Why then does hexdump show me the data at 0x7FFFFFFF when I specify 0xE864544000...

%  hexdump -n 16  -s 0xE864544000 -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

Confirming 0x7FFFFFFF:

%  hexdump -n 16  -s 0x7fffffff -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

I tried this on another Linux and see similar behavior. Is this a bug in hexdump or am I missing something?

share|improve this question

1 Answer 1

The max offset, '-s', that hexdump can use on an i686 Linux installation is (2^31-1) or 214783647 or in hex, 0x7FFFFFFF. The number you are trying to reach is way beyond this threshold. As @choroba pointed you must use a 64-bit Linux kernel to reach that address.

share|improve this answer
    
Works on my machine (64bit). –  choroba Jul 24 '13 at 23:04
    
It doesn't work on a i686, thanks @choroba –  cfreire Jul 24 '13 at 23:08
1  
Either you're on a 32bit machine, or you're using a 32bit compiled version of hexdump. (or both!!) If you're really adamant about looking at the end of the 1TB disk, try: dd if=/dev/bigdisk2 bs=1024M skip=1023 | hexdump ... This will skip the first 1023GB of the disk, then output the final Gig. Of course, a TB disk is not 1024GB, so adjust the number appropriately, this is only a conceptual example. –  lornix Jul 25 '13 at 2:04
    
Well I am on 64bit but my hexdump is 32. Thanks –  hexer Jul 25 '13 at 3:52
1  
This gave me the output I was expecting using 32bit hexdump... dd if=/dev/sda2 bs=1 skip=998115655680 | hexdump -n 16 -C –  hexer Jul 25 '13 at 3:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.