Viewing contents of hard drive in binary

Is there any way I can view contents of hard drive in hex or binary? I'm currently using debian

Solution 1:

Yes, you can open any block device as a file. As a matter of fact, the philosophy of Linux is everything is a file.

The block device you want to access is likely /dev/hda or /dev/sda. Since it is a very big file, I suggest you use wxHexEditor:

wxHexEditor /dev/sda

From the website:

wxHexEditor is not an ordinary hex editor, but could work as low level disk editor too. If you have problems with your HDD or partition, you can recover your data from HDD or from partition via editing sectors in raw hex.

You can edit your partition tables or you could recover files from File System by hand with help of wxHexEditor. Or you might want to analyze your big binary files, partitions, devices...

Solution 2:

With Unix-like operating systems, everything (including block devices such as hard disks) is a file. You could use a hexadecimal file dump utility (as superuser) to examine the raw contents of a disk device. xxd is normally distributed with the vim-common package but any hexdump utility will do. Disk partitions or any other disk-like block device (e.g., /dev/mapper/ if you are using LVM) can also be read. Pipe the output through less so that you can scroll through and search for the output:

sudo xxd /dev/sda | less

If you want to only find printable characters, you could use the strings utility (from the binutils package):

sudo strings /dev/sda | less    

Solution 3:

I was trying to do some spot checks on some 6TB drives that were wiped. Most commands read up to the offset specified and and don't seek to the offset. This is a problem on large input sources.

The following does a seek and is immediate / fast:

sudo dd if=/dev/sda skip=5T count=4kB iflags=skip_bytes,count_bytes 2>/dev/null | od | head

If the drive is wiped, some zeros are displayed with a multiplier; otherwise the head of the non wiped (zero) data is diplayed.