How to Use the hexdump Command to View Binary File Contents in Linux

The Purpose of hexdump

In Linux, when you want to view the contents of a standard text file, you use commands like cat, less, or head. These commands read the ASCII or UTF-8 encoded text and display it perfectly on your screen.

However, if you attempt to cat a compiled executable program (like a .bin file) or an image file (like a .png), your terminal will be flooded with garbled symbols, unreadable characters, and terminal control codes that might break your session. These files are not text; they are raw binary data.

The hexdump command is designed specifically for this scenario. It reads the raw bytes of a file and displays them safely in hexadecimal format, allowing developers, security researchers, and sysadmins to inspect the exact byte-level structure of any file.

Step 1: The Basic Hexdump Output

To view the raw bytes of a file, simply type hexdump followed by the filename.

hexdump /bin/ls

The output is heavily structured. It consists of three main columns:

1. Offset (Left Column): A hexadecimal number representing the byte position in the file. (e.g., 0000000 is the very beginning of the file, 0000010 is the next 16 bytes, etc.)
2. Hexadecimal Data (Middle Columns): The actual raw data, displayed as two-byte hexadecimal chunks (e.g., 457f 464c).
3. ASCII Representation (Right Column, if enabled): A text translation of the hex data, which is crucial for finding readable strings embedded in the binary code.

By default, hexdump does not show the ASCII translation, which makes the output very difficult to read.

Step 2: Canonical Output (The Most Useful Format)

To make the output truly useful, you should always use the -C (Canonical) flag. This forces hexdump to display the hex data in single bytes (rather than two-byte pairs) and adds a clean ASCII translation column on the far right.

hexdump -C /bin/ls | head -n 10

(We pipe it into head to only show the first 10 lines, as binaries are massive).

In the ASCII column on the right, you will often spot “Magic Numbers”—signatures that identify the file type. For example, if you run hexdump -C on a PNG image, the first few bytes in the ASCII column will visibly spell out .PNG. If it is a Linux executable, it will usually spell out .ELF.

Step 3: Limiting the Output

Because binary files are often megabytes or gigabytes in size, running hexdump on a whole file is usually a bad idea. If you only want to inspect the file header (the very beginning of the file) to identify what kind of file it is, use the -n (number of bytes) flag.

To read only the first 64 bytes of a file:

hexdump -C -n 64 mystery_file.bin

Step 4: Skipping Bytes

Conversely, if you know the file header is exactly 512 bytes long, and you only want to look at the raw data payload that occurs after the header, you can use the -s (skip) flag.

To skip the first 512 bytes and then read the next 64 bytes:

hexdump -C -s 512 -n 64 mystery_file.bin

By mastering the Canonical, Number, and Skip flags, you can surgically extract and inspect exact blocks of raw data from any file in Linux, regardless of whether you have the proper software to open it.