7

Is there any way I can view contents of hard drive in hex or binary? I'm currently using debian

  • As an aside, as you tagged as data-recovery: note that file contents might be stored in non-subsequent blocks on the disk. – Arjan Aug 21 '16 at 13:51
  • 1
    it isn't literally data recovery, I want to see what's left after full disk wipe, I want to check if I can find any plaintext, before wipe I created few dummy txt files with 200mb of 0xDEADBEEF in them – encore leet Aug 21 '16 at 13:56
12

Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.

The block device you want to access is likely /dev/hda or /dev/sda. Since it is a very big file, I suggest you use wxHexEditor:

wxHexEditor /dev/sda

From the website:

wxHexEditor is not an ordinary hex editor, but could work as low level disk editor too. If you have problems with your HDD or partition, you can recover your data from HDD or from partition via editing sectors in raw hex.

You can edit your partition tables or you could recover files from File System by hand with help of wxHexEditor. Or you might want to analyze your big binary files, partitions, devices...

wxHexEditor screenshot

  • wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely. – Royce Williams Feb 3 '18 at 19:40
8

With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd is normally distributed with the vim-common package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/ if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:

sudo xxd /dev/sda | less

If you want to only find printable characters, you could use the strings utility (from the binutils package):

sudo strings /dev/sda | less    
0

I was trying to do some spot checks on some 6TB drives that were wiped. Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.

The following does a seek and is immediate / fast:

sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head

If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.