How to View Binary Files Using the od Command in Linux

When you are inspecting binary executable files, compiled C object files, or raw memory dumps in a Linux environment, standard text editors are completely useless. If you attempt to open a binary file in nano, the editor will interpret the raw bytes as ASCII text, resulting in a chaotic screen of garbled symbols. While the hexdump command is the modern standard for analyzing these files, the legacy od (Octal Dump) command remains a powerful, highly configurable alternative that is guaranteed to be available on virtually every Unix-like system ever built.

How the od Command Works

By default, the od command reads a file byte by byte and prints the contents to the standard output in octal (base-8) format. This default behavior is an artifact of early computing history when octal notation was far more common than hexadecimal. Because reading raw octal data is incredibly difficult for modern administrators, od includes several formatting flags to translate the output into hexadecimal, decimal, or ASCII.

Outputting Data in Hexadecimal and ASCII

To make the output of od resemble modern canonical hexadecimal dumps (similar to hexdump -C), you must combine two formatting flags: -t x1 to output the data as single-byte hexadecimal blocks, and -c to output the data as printable ASCII characters.

od -t x1 -c /bin/ls | less

The output will be formatted into staggered rows. The first row will display the raw hexadecimal bytes, and the row immediately beneath it will display the corresponding ASCII characters, neatly aligned column-by-column.

0000000  7f  45  4c  46  02  01  01  00  00  00  00  00  00  00  00  00
        177   E   L   F 002 001 001  \0  \0  \0  \0  \0  \0  \0  \0  \0

If a byte corresponds to a printable character (like the E, L, and F of the ELF header), it will be printed clearly. If it is a non-printable control character, od will attempt to print its C-style escape sequence (like \0 for a null byte).

Skipping Bytes (The -j Flag)

If you are analyzing a massive 2-gigabyte database file, you do not want to start dumping data from byte zero. If you know the exact memory address or offset where the corruption occurred, you can instruct od to skip ahead using the -j flag.

od -j 1024 -t x1 -c data.bin | less

This command tells od to silently jump over the first 1,024 bytes of the file and begin printing the hexadecimal output starting exactly at byte 1,025. This is incredibly useful for bypassing known headers and jumping straight into the payload data.