How to View File Contents in Hexadecimal Using the hexdump Command in Linux

When you need to analyze the raw, underlying data of a compiled binary, a corrupted disk image, or an unknown file type, a standard text editor like nano or vim will fail. Standard editors attempt to interpret raw binary data as printable ASCII characters, resulting in a screen full of garbled text and warning beeps. To safely inspect the exact bytes that make up any file, Linux administrators rely on the hexdump command, which translates raw data into a readable hexadecimal format.

How the hexdump Command Works

The hexdump utility reads the specified file byte by byte and outputs the data to your terminal. By default, it formats this output into columns of two-byte hexadecimal blocks. However, the default output lacks context, so administrators almost always use specific formatting flags to make the data understandable.

Using the Canonical Format (The -C Flag)

The most common and useful way to run the command is with the -C (Canonical) flag. This forces hexdump to display the data in three distinct, side-by-side columns: the memory offset, the raw hexadecimal bytes, and the ASCII translation.

hexdump -C /bin/ls | less

Note: Because binaries are massive, always pipe the output into less so you can scroll through it without flooding your terminal screen.

When you look at the canonical output, you will see a structure like this:

00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  03 00 3e 00 01 00 00 00  50 5f 00 00 00 00 00 00  |..>.....P_......|

Here is how to read it:

1. Left Column (00000000): This is the byte offset (the address) indicating exactly how far into the file you are looking. It is printed in hexadecimal.
2. Middle Column (7f 45 4c 46…): These are the actual raw bytes of the file, printed as 16 hexadecimal pairs per row.
3. Right Column (|.ELF…|): This is the ASCII translation of those exact same 16 bytes. If a byte corresponds to a printable character (like an ‘E’ or an ‘L’), it is printed here. If it is non-printable (like a raw memory instruction), a dot (.) is printed instead as a placeholder.

Identifying Unknown Files

The canonical output is incredibly useful for cybersecurity analysis and identifying corrupted files. Almost all file types begin with a “magic number” (a specific sequence of bytes at the very start of the file) that identifies the format regardless of the file extension.

For example, if you run hexdump -C on a mysterious file and the ASCII column on the very first row reads %PDF-1.4, you instantly know the file is actually a PDF document, even if the user maliciously renamed it to image.jpg to bypass a firewall filter.