3

I'm trying to hexdump some bytes near the end of a 1 TB hard disk drive. First, let's look near the beginning, 0x1000:

%  hexdump -n 16  -s 0x1000 -C /dev/sda2

00001000  08 70 b5 7c 20 4c 56 4d  32 20 78 5b 35 41 25 72  |.p.| LVM2 x[5A%r|

And confirming with hexedit, we see hexdump worked fine:

00001000   08 70 B5 7C  20 4C 56 4D  32 20 78 5B  35 41 25 72

Now the problem. hexedit shows near the end, at offset 0xE864544000:

64544000   FC 4E 2B A9  01 00 00 00  00 00 00 00  00 00 00 00

Why then does hexdump show me the data at 0x7FFFFFFF when I specify 0xE864544000...

%  hexdump -n 16  -s 0xE864544000 -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

Confirming 0x7FFFFFFF:

%  hexdump -n 16  -s 0x7fffffff -C /dev/sda2

7fffffff  13 29 24 50 54 47 31 00  10 14 80 47 db 46 61 4e  |.)$PTG1....G.FaN|

I tried this on another Linux and see similar behavior. Is this a bug in hexdump or am I missing something?

Improve this question

1 Answer 1

Reset to default
3

The max offset, '-s', that hexdump can use on an i686 Linux installation is (2^31-1) or 214783647 or in hex, 0x7FFFFFFF. The number you are trying to reach is way beyond this threshold. As @choroba pointed you must use a 64-bit Linux kernel to reach that address.

Improve this answer
4
  • Works on my machine (64bit).
    – choroba
    Commented Jul 24, 2013 at 23:04
  • 1
    Either you're on a 32bit machine, or you're using a 32bit compiled version of hexdump. (or both!!) If you're really adamant about looking at the end of the 1TB disk, try: dd if=/dev/bigdisk2 bs=1024M skip=1023 | hexdump ... This will skip the first 1023GB of the disk, then output the final Gig. Of course, a TB disk is not 1024GB, so adjust the number appropriately, this is only a conceptual example.
    – lornix
    Commented Jul 25, 2013 at 2:04
  • Well I am on 64bit but my hexdump is 32. Thanks
    – hexer
    Commented Jul 25, 2013 at 3:52
  • 1
    This gave me the output I was expecting using 32bit hexdump... dd if=/dev/sda2 bs=1 skip=998115655680 | hexdump -n 16 -C
    – hexer
    Commented Jul 25, 2013 at 3:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .