Viewing contents of hard drive in binary
Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.
The block device you want to access is likely /dev/hda
or /dev/sda
. Since it is a very big file, I suggest you use wxHexEditor:
wxHexEditor /dev/sda
From the website:
wxHexEditor is not an ordinary hex editor, but could work as low level disk editor too. If you have problems with your HDD or partition, you can recover your data from HDD or from partition via editing sectors in raw hex.
You can edit your partition tables or you could recover files from File System by hand with help of wxHexEditor. Or you might want to analyze your big binary files, partitions, devices...
With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd
is normally distributed with the vim-common
package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/
if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:
sudo xxd /dev/sda | less
If you want to only find printable characters, you could use the strings
utility (from the binutils
package):
sudo strings /dev/sda | less
I was trying to do some spot checks on some 6TB drives that were wiped. Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.
The following does a seek and is immediate / fast:
sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head
If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.