TL;DR
Here are the best ways to use the Linux hexdump command for inspecting the content of different file types:
- View any file type content in hexadecimal format using
hexdump [options] file
. - Analyze PDF documents with
hexdump -C -n 40 filename.pdf
to view the file header. - Use
hexdump -C filename.txt
to inspect text files in hexadecimal and ASCII format. - View image files with the
hexdump -C filename.png | head -n 10
command to identify specific details about its contents. - Examine audio files by running
hexdump -C audio.mp3 | head -n 20
in the Terminal to view file format information and metadata.
Read on the article below to get hands-on experience in file content analysis with the Linux hexdump command using the ten practical examples and three valuable practices.
Whether you’re analyzing binary files, inspecting network packets, or performing low-level data recovery, you’ll find clear instructions to utilize hexdump’s full potential. Let’s enhance your Linux command-line skills and simplify complex data analysis tasks.
What is hexdump?
Hexdump is a command-line tool in Linux that lets you view the contents of a file in hexadecimal format. This means it displays the binary data of a file as hexadecimal numbers, which are easier to read and understand than raw binary.
Hexdump is especially useful when you need to:
- Data Recovery: If you need to recover data from a corrupted file or disk, hexdump can show you the remaining readable parts of the data.
- Analyze Binary Files: Sometimes you need to look at the raw data in a file, especially if it’s not a text file. Hexdump helps by showing you the exact bytes in a readable format.
- Debug Programs: Developers often use hexdump to see the actual data being processed by their programs. This helps in finding bugs or understanding how the data is structured.
- Network Analysis: Network engineers use hexdump to inspect network packets. By converting packet data into hexadecimal, they can see the details of the communication between devices.
Installation and Setup of hexdump
Here’s how to check if it’s installed and how to install it on different Linux distributions.
- Open your terminal.
- Type the following command:
hexdump --version
- Press Enter.
If hexdump is installed, you will see its version number. If it’s not installed, you will get a “command not found” message.

- If hexdump is not installed, first update your package list. :
sudo apt update

- Then install bsdmainutils package (hexdump is part of this package):
sudo apt install bsdmainutils

How to Use Linux hexdump Command
To use the Linux hexdump command, open your terminal and type hexdump [options] file
, replacing [options]
with any specific flags you need and file
with the name of the file you want to analyze. For example, hexdump -C filename.txt
displays the file contents in both hexadecimal and ASCII format. Use -n
to limit bytes, -s
to skip bytes, and -e
for custom formats. This command helps in viewing and analyzing the raw data of files in an easy-to-read format.
Keep reading for ten easy uses of hexdump command in Linux:
1. Hexadecimal File View
The hexdump command displays file contents in hexadecimal format, with each line representing a certain number of bytes, typically 16 or 32. Key output columns include the byte offset, hexadecimal representation of bytes, and ASCII representation of non-printable characters. Here’s how you can use this command to view the file content in hexadecimal format:
- Run the basic syntax of the Linux hexdump command with the file name that you wish to view in the hexadecimal format.
hexdump [options] file
- You’ll see the following output for your file content in the Terminal window:

- Apart from this basic hexdump command style, you can add
-C
for ASCII and hexadecimal format,-n
to limit bytes,-s
to skip bytes,-b
for the octal format,-e
for a custom format, and-v
for a verbose display. Read the section below to learn more about these options.
2. Analyse the PDF Documents
PDF documents have binary characters, which can be read with the Linux hexdump command. You can use hexdump to analyze its contents and extract certain information from it. To do so, follow the steps below:
- In the Terminal window, enter the following command:
hexdump -C -n 40 filename.pdf
- This command line will display the first 40 bytes of the file in both hexadecimal and ASCII format.

- You can now examine the output to see the file header. It tells you that it is a PDF object, as it starts with %PDF, while the string indicates the title hexfile.
3. Inspect Text Files
The Linux hexdump command is a useful tool for inspecting the contents of a text file. If you’re working with a text file and need to analyze its contents, this command can be an invaluable resource. Here’s a step-by-step guide on how to use the Linux hexdump command to view the contents of a text file:
- Launch the command prompt and execute the command below:
hexdump -C filename.txt
- This will display the contents of the file in both hexadecimal and ASCII format.

- You can scroll down and view the whole output to read the content of the text file without opening it via GUI.
4. View Image Files
Image files are also stored in binary format, which means that you can use the Linux hexdump command to view the hexadecimal representation. With this command, you can identify specific details about its contents. Here’s how you can do it:
- Launch the Terminal window and execute the following command:
hexdump -C filename.png | head -n 10
- This will display the first line of the hexdump output for the image file’s header. The header contains information about the image’s format and other details.

- In our case, the image file is in PNG format. You may also see image software information from which it was captured. For instance, I have used Greenshot to capture this image.
- You can now use this information to make decisions about manipulating your image file, such as changing the format from PNG to JPEG while preserving its resolution to reduce the file size and more.
5. Examine Audio Files
hexdump can also reveal the details about audio files, including audio data, metadata, and file format information. Follow these steps to examine the header of an MP3 audio file with the hexdump command:
- Execute the following command in the Terminal app:
hexdump -C audio.mp3 | head -n 20
- This will display the first 20 lines of the audio file. It contains information about the file format, metadata, and other details.

- For example, in the above output, you may see the metadata information of the MP3 file, such as the title, artist, and album of the song.
- You can target specific portions of the audio data and use other tools, like FFmpeg or Audacity, to extract portions of the original file. This is helpful for audio engineers, musicians, or anyone working with audio files in a professional capacity.
6. Read Archive Files
Archive files are commonly used to store multiple compressed files or directories, and the Linux hexdump command can help examine their contents. Here’s how you can do it in just a few easy steps:
- Run the following command in the Linux command prompt:
hexdump -C archive.zip | head -n 10
- This will display the first 10 lines of the Hexdump output for the archive file. The header may contain information about the file name, format, and other details.

- In the above output, this command displays the file names and their extensions that are compressed within this archive file. Like, file.txt in the second line and Maybe.mp3 in the second last line of the output.
- So, if you need to extract specific files from the archive, you can first view those files and then use tools. like 7-Zip, to extract them.
7. Search for a Specific Pattern
You can use the grep command to search for a specific byte pattern in the hexdump output. Here’s how you can combine the Linux hexdump command with grep:
- Open a Terminal window and enter the following command:
hexdump -C filename.txt | grep "pattern"
- Make sure to replace the pattern with the byte pattern you’re looking for. And you’ll have the output for that particular term.

- Examine the output to see where the pattern is located in the file. This makes it easier to locate particular terms in large files.
8. Visualizing Network Data
Visualizing network data is crucial for analyzing and debugging raw network packets. By using the hexdump command, you can convert binary packet data into a readable hexadecimal and ASCII format.
- First, you need to capture network data using a tool like tcpdump or wireshark. For example, to capture data and save it to a file called packet.bin, use:
tcpdump -c 10 -w packet.bin

- Once you have the captured data file, use the cat command to pipe its contents to hexdump:
cat packet.bin | hexdump -C
This command will display the data in a canonical hex+ASCII format, which includes both hexadecimal values and their corresponding ASCII characters.
Examine the output to identify patterns, headers, and payloads within the network packet. This can help in troubleshooting network issues or understanding the data flow.

9. Dumping Data from a Device
Dumping data from a device is useful for low-level data recovery or analysis. The hexdump command allows you to view the raw contents of a device, such as a hard drive partition.
- Determine the device you want to dump data from. Common devices include hard drive partitions like /dev/sda1. Use lsblk or fdisk -l to list available devices and partitions:
lsblk

- Use the hexdump command to output the raw data from the identified device:
sudo hexdump /dev/sda1
The sudo command is often required as accessing device data typically requires root permissions.
The command will display the raw data in hexadecimal format. This can be useful for forensic analysis, data recovery, or understanding the low-level structure of the data on the device.

10. Comparing Binary Files
Comparing binary files is essential for identifying differences, changes, or corruption in data. By using cmp and hexdump together, you can compare two binary files byte-by-byte and visualize the differences in a readable format.
- Ensure you have the two binary files you want to compare, named file1 and file2.
- Use the cmp command with the –print-bytes option to compare the files and pipe the output to hexdump:
cmp --print-bytes file1 file2 | hexdump
This command will output the differences between the two files in hexadecimal format.
Examine the output to identify the exact bytes that differ between the two files. This can help in pinpointing changes, understanding corruption, or verifying data integrity.

3 Best Practices to Use Linux hexdump Command
To get the most out of the Linux hexdump command, it’s important to follow some best practices. Here are three valuable tips that can help you use the command more efficiently:
1. Use Pipes and Redirection to Chain Commands
With the ability to display the hexadecimal and ASCII values of a file, the hexdump command can be used in combination with other Linux commands to perform more complex operations. For example, to display the contents of a file in reverse order, use the following command:
hexdump -C hexfile.txt | tac
In this command, the -C
option with the name of the file as an argument. It outputs the contents of the file in a hexdump format, with ASCII characters displayed to the right of the hexadecimal values.
While the |
symbol, known as a pipe, is used to redirect the output of one command to the input of another command.
And the tac
command can be used in combination with hexdump
to reverse the order of lines in the output. So, by piping the output of hexdump
to tac
, the contents of the file are displayed in reverse order in the terminal.

2. Use Options to Handle Large Files
When dealing with large files, it’s crucial to use the -s
and -n
options with the hexdump command to limit the amount of data being processed at once. The -s
option sets the starting offset in the file for reading data, and the -n
option specifies the number of bytes to be processed.
These options help prevent memory issues and ensure that the command runs efficiently. Here’s an example of how to use the Linux hexdump command with these options:
hexdump -C -s 1000 -n 100 hexfile.txt
This command will start reading the file hexfile.txt at offset 1000 and process only the next 100 bytes of data. This helps ensure that the command is not overwhelmed with data and that it can complete its processing without issues.

3. Know Your Output Formats
By default, the Linux hexdump command displays output in hexadecimal format. However, to display output in a combined hexadecimal and ASCII format, use the -C
option. This format provides both the hexadecimal and ASCII representation of the input data in two columns.
Also, you can add the -b
option to display output in octal format. The octal output displays each byte of data as three octal digits, with the ASCII representation displayed to the right. With these options, here’s what your Linux hexdump command should look like:
hexdump -C -b hexfile.txt
If this command is executed, it will display the contents of the file in octal format. The -C
option tells the command to display the output in a more user-friendly format, with ASCII characters on the right side of each line.
And the -b
option specifies that the output should be in octal format, which means that each byte is represented by a three-digit octal number.

To Sum Up
In this article, I explored various methods to use the hexdump command in Linux, from visualizing network data to dumping device data and comparing binary files. These methods demonstrate the versatility of hexdump for analyzing and debugging different data types.
If you enjoyed this guide, I recommend checking out more articles to deepen your Linux knowledge:
- Explore the find command to locate files and directories with precision, enhancing your ability to manage and organize data on your system.
- Discover how the help command can quickly show command usage and options, making it easier to navigate and use various Linux commands.
- Learn advanced text search techniques by mastering grep with OR conditions, which will help you filter and find information efficiently.
Frequently Asked Questions
How can I view the Linux hexdump output in a more human-readable format?
-C
option, which displays the ASCII representation of each byte alongside the hexadecimal representation.Is there a limit to the size of the file that can be analyzed with the hexdump command?
-s
and -n
options to limit the amount of data that the command processes at once.