Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to hexdump some bytes near the end of a 1 TB hard disk drive. First, let's look near the beginning, 0x1000:

%  hexdump -n 16  -s 0x1000 -C /dev/sda2

00001000  08 70 b5 7c 20 4c 56 4d  32 20 78 5b 35 41 25 72  |.p.| LVM2 x[5A%r|

And confirming with hexedit, we see hexdump worked fine:

00001000   08 70 B5 7C  20 4C 56 4D  32 20 78 5B  35 41 25 72

Now the problem. hexedit shows near the end, at offset 0xE864544000:

64544000   FC 4E 2B A9  01 00 00 00  00 00 00 00  00 00 00 00

Why then does hexdump show me the data at 0x7FFFFFFF when I specify 0xE864544000...

%  hexdump -n 16  -s 0xE864544000 -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

Confirming 0x7FFFFFFF:

%  hexdump -n 16  -s 0x7fffffff -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

I tried this on another Linux and see similar behavior. Is this a bug in hexdump or am I missing something?

share|improve this question

The max offset, '-s', that hexdump can use on an i686 Linux installation is (2^31-1) or 214783647 or in hex, 0x7FFFFFFF. The number you are trying to reach is way beyond this threshold. As @choroba pointed you must use a 64-bit Linux kernel to reach that address.

share|improve this answer
    
Works on my machine (64bit). – choroba Jul 24 '13 at 23:04
    
It doesn't work on a i686, thanks @choroba – cfreire Jul 24 '13 at 23:08
1  
Either you're on a 32bit machine, or you're using a 32bit compiled version of hexdump. (or both!!) If you're really adamant about looking at the end of the 1TB disk, try: dd if=/dev/bigdisk2 bs=1024M skip=1023 | hexdump ... This will skip the first 1023GB of the disk, then output the final Gig. Of course, a TB disk is not 1024GB, so adjust the number appropriately, this is only a conceptual example. – lornix Jul 25 '13 at 2:04
    
Well I am on 64bit but my hexdump is 32. Thanks – hexer Jul 25 '13 at 3:52
1  
This gave me the output I was expecting using 32bit hexdump... dd if=/dev/sda2 bs=1 skip=998115655680 | hexdump -n 16 -C – hexer Jul 25 '13 at 3:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .