Using Hexdump to Analyze Binary Files in Linux

The hexdump command is a standard Linux command-line utility used to inspect and interpret files that are not composed of plain text. This article covers the core purpose of hexdump in binary file analysis, explains how it translates raw bytes into readable hexadecimal and ASCII representations, and demonstrates essential options for inspecting binary structures, headers, and hidden data.

The Core Purpose of Hexdump

Binary files—such as compiled executables, firmware images, compressed archives, and media files—contain machine-readable data that cannot be displayed properly in standard text editors. Opening a binary file in a regular editor usually results in broken characters, terminal control code execution, or system lockups.

The hexdump command solves this problem by transforming raw binary bytes into formatted, human-readable representations. It displays data simultaneously in hexadecimal notation and, optionally, ASCII characters. This enables systems administrators, software developers, and security analysts to view the exact layout of bytes stored within a file.

Key Use Cases in Binary Analysis

Identifying File Formats via Magic Bytes
Every file format typically begins with a unique signature known as "magic bytes." For instance, Linux executable files (ELF) start with the byte sequence 7f 45 4c 46. Analysts use hexdump to read the first few bytes of an unknown or mislabeled file to determine its authentic format regardless of its file extension.
Reverse Engineering and Firmware Inspection
When analyzing closed-source binaries or hardware firmware, hexdump allows analysts to locate embedded components, such as file systems, encryption keys, or configuration blocks, by examining byte offsets and memory boundaries.
Data Recovery and Forensics
During forensic investigations, corrupted files or raw disk images can be examined at the byte level. hexdump makes it possible to locate salvageable headers, metadata, or residual data left in slack space.
Debugging Network and Memory Dumps
Raw dumps of network traffic or process memory often contain a mix of binary protocol headers and textual payloads. Hexdump formats this raw data so analysts can track byte alignment and structure.

Essential Hexdump Syntax and Flags

The default output of hexdump provides 2-byte hexadecimal values, which can be difficult to read. Analysts commonly use specific flags to make the data actionable:

Canonical Hex+ASCII Display (-C)
The -C flag is the standard choice for binary analysis. It organizes the output into three distinct columns: the byte offset, the raw data in two-character hexadecimal bytes, and the ASCII translation. Non-printable characters are represented by a period (.):
```
hexdump -C target_file.bin
```
Limiting the Inspection Length (-n)
To analyze only a specific portion of a file, such as a header, the -n option limits output to a specific number of bytes:
```
hexdump -C -n 16 target_file.bin
```
Starting at a Specific Offset (-s)
When seeking data located deep within a binary, the -s flag skips a defined number of bytes from the beginning:
```
hexdump -C -s 0x100 -n 32 target_file.bin
```

By translating unreadable binary streams into structured hexadecimal and ASCII views, hexdump acts as a fundamental first-line tool for low-level system analysis, triage, and reverse engineering on Linux.