Viewing contents of hard drive in binary
Is there any way I can view contents of hard drive in hex or binary? I'm currently using debian
linux hard-drive data-recovery
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
add a comment |
Is there any way I can view contents of hard drive in hex or binary? I'm currently using debian
linux hard-drive data-recovery
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
As an aside, as you tagged asdata-recovery: note that file contents might be stored in non-subsequent blocks on the disk.
– Arjan
Aug 21 '16 at 13:51
1
it isn't literally data recovery, I want to see what's left after full disk wipe, I want to check if I can find any plaintext, before wipe I created few dummy txt files with 200mb of 0xDEADBEEF in them
– encore leet
Aug 21 '16 at 13:56
add a comment |
Is there any way I can view contents of hard drive in hex or binary? I'm currently using debian
linux hard-drive data-recovery
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
Is there any way I can view contents of hard drive in hex or binary? I'm currently using debian
linux hard-drive data-recovery
linux hard-drive data-recovery
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
asked Aug 21 '16 at 13:09
encore leetencore leet
2313
2313
As an aside, as you tagged asdata-recovery: note that file contents might be stored in non-subsequent blocks on the disk.
– Arjan
Aug 21 '16 at 13:51
1
it isn't literally data recovery, I want to see what's left after full disk wipe, I want to check if I can find any plaintext, before wipe I created few dummy txt files with 200mb of 0xDEADBEEF in them
– encore leet
Aug 21 '16 at 13:56
add a comment |
As an aside, as you tagged asdata-recovery: note that file contents might be stored in non-subsequent blocks on the disk.
– Arjan
Aug 21 '16 at 13:51
1
it isn't literally data recovery, I want to see what's left after full disk wipe, I want to check if I can find any plaintext, before wipe I created few dummy txt files with 200mb of 0xDEADBEEF in them
– encore leet
Aug 21 '16 at 13:56
As an aside, as you tagged as
data-recovery: note that file contents might be stored in non-subsequent blocks on the disk.– Arjan
Aug 21 '16 at 13:51
As an aside, as you tagged as
data-recovery: note that file contents might be stored in non-subsequent blocks on the disk.– Arjan
Aug 21 '16 at 13:51
1
1
it isn't literally data recovery, I want to see what's left after full disk wipe, I want to check if I can find any plaintext, before wipe I created few dummy txt files with 200mb of 0xDEADBEEF in them
– encore leet
Aug 21 '16 at 13:56
it isn't literally data recovery, I want to see what's left after full disk wipe, I want to check if I can find any plaintext, before wipe I created few dummy txt files with 200mb of 0xDEADBEEF in them
– encore leet
Aug 21 '16 at 13:56
add a comment |
3 Answers
3
active
oldest
votes
Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.
The block device you want to access is likely /dev/hda or /dev/sda. Since it is a very big file, I suggest you use wxHexEditor:
wxHexEditor /dev/sda
From the website:
wxHexEditor is not an ordinary hex editor, but could work as low level
disk editor too. If you have problems with your HDD or partition, you
can recover your data from HDD or from partition via editing sectors
in raw hex.
You can edit your partition tables or you could recover
files from File System by hand with help of wxHexEditor. Or you might
want to analyze your big binary files, partitions, devices...
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely.
– Royce Williams
Feb 3 '18 at 19:40
add a comment |
With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd is normally distributed with the vim-common package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/ if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:
sudo xxd /dev/sda | less
If you want to only find printable characters, you could use the strings
utility (from the binutils package):
sudo strings /dev/sda | less
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
add a comment |
I was trying to do some spot checks on some 6TB drives that were wiped.
Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.
The following does a seek and is immediate / fast:
sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head
If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.
answered Jan 18 at 19:40
Scott P.Scott P.
1011
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1115972%2fviewing-contents-of-hard-drive-in-binary%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.
The block device you want to access is likely /dev/hda or /dev/sda. Since it is a very big file, I suggest you use wxHexEditor:
wxHexEditor /dev/sda
From the website:
wxHexEditor is not an ordinary hex editor, but could work as low level
disk editor too. If you have problems with your HDD or partition, you
can recover your data from HDD or from partition via editing sectors
in raw hex.
You can edit your partition tables or you could recover
files from File System by hand with help of wxHexEditor. Or you might
want to analyze your big binary files, partitions, devices...
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely.
– Royce Williams
Feb 3 '18 at 19:40
add a comment |
Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.
The block device you want to access is likely /dev/hda or /dev/sda. Since it is a very big file, I suggest you use wxHexEditor:
wxHexEditor /dev/sda
From the website:
wxHexEditor is not an ordinary hex editor, but could work as low level
disk editor too. If you have problems with your HDD or partition, you
can recover your data from HDD or from partition via editing sectors
in raw hex.
You can edit your partition tables or you could recover
files from File System by hand with help of wxHexEditor. Or you might
want to analyze your big binary files, partitions, devices...
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely.
– Royce Williams
Feb 3 '18 at 19:40
add a comment |
Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.
The block device you want to access is likely /dev/hda or /dev/sda. Since it is a very big file, I suggest you use wxHexEditor:
wxHexEditor /dev/sda
From the website:
wxHexEditor is not an ordinary hex editor, but could work as low level
disk editor too. If you have problems with your HDD or partition, you
can recover your data from HDD or from partition via editing sectors
in raw hex.
You can edit your partition tables or you could recover
files from File System by hand with help of wxHexEditor. Or you might
want to analyze your big binary files, partitions, devices...
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.
The block device you want to access is likely /dev/hda or /dev/sda. Since it is a very big file, I suggest you use wxHexEditor:
wxHexEditor /dev/sda
From the website:
wxHexEditor is not an ordinary hex editor, but could work as low level
disk editor too. If you have problems with your HDD or partition, you
can recover your data from HDD or from partition via editing sectors
in raw hex.
You can edit your partition tables or you could recover
files from File System by hand with help of wxHexEditor. Or you might
want to analyze your big binary files, partitions, devices...
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
edited Apr 30 '17 at 17:17
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
answered Aug 23 '16 at 11:35
Andrea LazzarottoAndrea Lazzarotto
692314
692314
wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely.
– Royce Williams
Feb 3 '18 at 19:40
add a comment |
wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely.
– Royce Williams
Feb 3 '18 at 19:40
wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely.
– Royce Williams
Feb 3 '18 at 19:40
wxHexEditor is especially suitable for disk editing because you can jump to a specific sector or offset, toggle from read-only to write, make a specific edit, and then toggle back to read-only mode - efficiently and safely.
– Royce Williams
Feb 3 '18 at 19:40
add a comment |
With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd is normally distributed with the vim-common package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/ if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:
sudo xxd /dev/sda | less
If you want to only find printable characters, you could use the strings
utility (from the binutils package):
sudo strings /dev/sda | less
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
add a comment |
With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd is normally distributed with the vim-common package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/ if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:
sudo xxd /dev/sda | less
If you want to only find printable characters, you could use the strings
utility (from the binutils package):
sudo strings /dev/sda | less
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
add a comment |
With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd is normally distributed with the vim-common package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/ if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:
sudo xxd /dev/sda | less
If you want to only find printable characters, you could use the strings
utility (from the binutils package):
sudo strings /dev/sda | less
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd is normally distributed with the vim-common package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/ if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:
sudo xxd /dev/sda | less
If you want to only find printable characters, you could use the strings
utility (from the binutils package):
sudo strings /dev/sda | less
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
answered Aug 21 '16 at 19:58
Anthony GeogheganAnthony Geoghegan
2,8191430
2,8191430
add a comment |
add a comment |
I was trying to do some spot checks on some 6TB drives that were wiped.
Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.
The following does a seek and is immediate / fast:
sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head
If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.
answered Jan 18 at 19:40
Scott P.Scott P.
1011
add a comment |
I was trying to do some spot checks on some 6TB drives that were wiped.
Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.
The following does a seek and is immediate / fast:
sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head
If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.
answered Jan 18 at 19:40
Scott P.Scott P.
1011
add a comment |
I was trying to do some spot checks on some 6TB drives that were wiped.
Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.
The following does a seek and is immediate / fast:
sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head
If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.
answered Jan 18 at 19:40
Scott P.Scott P.
1011
I was trying to do some spot checks on some 6TB drives that were wiped.
Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.
The following does a seek and is immediate / fast:
sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head
If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.
answered Jan 18 at 19:40
Scott P.Scott P.
1011
answered Jan 18 at 19:40
Scott P.Scott P.
1011
answered Jan 18 at 19:40
Scott P.Scott P.
1011
answered Jan 18 at 19:40
Scott P.Scott P.
1011
1011
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1115972%2fviewing-contents-of-hard-drive-in-binary%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
As an aside, as you tagged as
data-recovery: note that file contents might be stored in non-subsequent blocks on the disk.– Arjan
Aug 21 '16 at 13:51
1
it isn't literally data recovery, I want to see what's left after full disk wipe, I want to check if I can find any plaintext, before wipe I created few dummy txt files with 200mb of 0xDEADBEEF in them
– encore leet
Aug 21 '16 at 13:56