The  od  data dump command (and others)

The od ("octal dump") command is a useful, venerable unix command in the "data dump" program category. Such programs show data in terms of their byte values. So for example since a letter A is represented by the bit pattern 01000001 as assigned arbitrarily by the American Standard Code for Information Interchange (ASCII), a dump program would show that A as that number. That's different from how an editor would show it. Editors show it as "A", painting the shape of the letter on the screen just as we are accustomed to it. But in the computer there's no such shape, just the number 01000001. A text editor sees that number and puts A on the screen. A dump program sees that same number and puts the number itself on the screen.

The dump program has a number-base choice when printing the number. It might actually print "01000001" in exactly that native base-2 representation. More commonly, it puts the same number into its base-8 (octal), base-10 (decimal), or base-16 (hexadecimal) representation instead. What you would see on screen repectively would be 101 (sixty-four plus one), 41 (four times sixteen plus one), or 65 (six times ten plus five). Let's look at the od program and see the syntax that implements this choice.

At the bottom of the page is a screenshot of od applied in different ways to each of 3 files. The files are named ABC, dumpme, and mbr-assignement.img. File ABC contains just 3 bytes, namely characters A, B, and C. File dumpme is a little longer and also contains text, namely:

Hello.
The whole alphabet is on the next line:
ABCDEFGHIJKLMNOPQRSTUVWXYZ
And the 10 numerals on the next line:
0123456789
Good-bye.

While file mbr-assignment.img doesn't contain pure text but rather is binary (contains other numbers than the ones used for representing the alphabet; there are more numbers that a byte could have which don't represent any character than those that do).

Choosing the number base for presenting the data

od has a -t option for choosing a number base. The option letter is to be followed by a type specification which can be x if you want hexadecimal, u if you want (unsigned) decimal, o if octal, or any of 4 other possibilities. The od commands in our screenshot, listed here, show data in either hex or in decimal as determined by the highlighted syntax:

 

od -Ad -tx1 ABC
od -Ad -tx1z ABC
od -Ad -tu1 ABC
od -Ad -tu1z ABC

od -Ad -tx1 dumpme
od -Ad -tx1z dumpme
od -Ad -tu1 dumpme

od -Ad -tx1 mbr-assignment.img
od -Ad -tx1z mbr-assignment.img

Look at the screenshot and note the applied effect of this syntax. ABC shows as either 41 42 43, which is hex, in response to -tx; or it shows as 65 66 67, which is decimal, in response to -tu. Most of the time data dump programs are used to depict data in hexadecimal so they are usually called "hex dump" programs. You could accurately say that od is a hex dump program, even though its name is octal dump.

Choosing the number base for addressing the presented data

A second feature here is the choice of number base for the index values, or offset addresses, that appear in a column to the left of the data itself. The data is printed in rows, 16 bytes to a row. So the last byte in the first row is the sixteenth byte in the data, and the first byte in the second row is the seventeenth. That byte is labeled 0000016 to express "seventeenth." Counting here starts with zero, that is, the first byte in the data is number zero. Consequently, the second byte is number 1, the third is number 2, the ninth is number eight, the one-hundredth is number ninety-nine, and so forth. od decides which number base to use for these offsets in accord with its -A option (A stands for address). You must follow the -A with any of 4 possible values for the "radix" (fancy talk, radix is "root" in Latin, meaning number base). All commands in our screenshot use decimal for the addressing:

od -Ad -tx1 ABC
od -Ad -tx1z ABC
od -Ad -tu1 ABC
od -Ad -tu1z ABC

od -Ad -tx1 dumpme
od -Ad -tx1z dumpme
od -Ad -tu1 dumpme

od -Ad -tx1 mbr-assignment.img
od -Ad -tx1z mbr-assignment.img

Choosing in how many bytes-at-a-time to group the data

Since numeric data in computers is often stored in "data types" with a single number stored in a series of bytes in some width, usually 1, 2, 4, or 8 bytes, od likes to present data in byte pairs or groups. I don't like that. I want to see the bytes one after the other, in the order they appear in the data source. Here's how I tell od to do it that way:

od -Ad -tx1 ABC
od -Ad -tx1z ABC
od -Ad -tu1 ABC
od -Ad -tu1z ABC

od -Ad -tx1 dumpme
od -Ad -tx1z dumpme
od -Ad -tu1 dumpme

od -Ad -tx1 mbr-assignment.img
od -Ad -tx1z mbr-assignment.img

Choosing whether to also show the ASCII representation of the data's ASCII charcters

od -Ad -tx1 ABC
od -Ad -tx1z ABC
od -Ad -tu1 ABC
od -Ad -tu1z ABC

od -Ad -tx1 dumpme
od -Ad -tx1z dumpme
od -Ad -tu1 dumpme

od -Ad -tx1 mbr-assignment.img
od -Ad -tx1z mbr-assignment.img

Look to the right of the main data dumps. Where a z appears here, an ascii representation of the data can additionally be seen.

Related tools

Another hex dump tool in linux is xxd. Use its -g1 option to show files as successive, single bytes in order, e.g., xxd -g1 myfile.

Hex dump tools are read-only but may have a write feature, enabling low level byte editing by byte value. Such tools are called hex editors. A hex editor for linux is bvi. It is comfortable for vi users because it uses that editor's keystroke commands. In Windows HxD and xvi32 are good, free hex editors.


Screenshot:

[root@instructor shared]# od -Ad -tx1 ABC
0000000 41 42 43
0000003
[root@instructor shared]# od -Ad -tx1z ABC
0000000 41 42 43                                         >ABC<
0000003
[root@instructor shared]# od -Ad -tu1 ABC
0000000  65  66  67
0000003
[root@instructor shared]# od -Ad -tu1z ABC
0000000  65  66  67                                                      >ABC<
0000003
[root@instructor shared]#
[root@instructor shared]# 
[root@instructor shared]# 
[root@instructor shared]# cat dumpme
Hello.
The whole alphabet is on the next line:
ABCDEFGHIJKLMNOPQRSTUVWXYZ
And the 10 numerals on the next line:
0123456789
Good-bye.
[root@instructor shared]# 
[root@instructor shared]# od -Ad -tx1 dumpme 
0000000 48 65 6c 6c 6f 2e 0a 54 68 65 20 77 68 6f 6c 65
0000016 20 61 6c 70 68 61 62 65 74 20 69 73 20 6f 6e 20
0000032 74 68 65 20 6e 65 78 74 20 6c 69 6e 65 3a 0a 41
0000048 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51
0000064 52 53 54 55 56 57 58 59 5a 0a 41 6e 64 20 74 68
0000080 65 20 31 30 20 6e 75 6d 65 72 61 6c 73 20 6f 6e
0000096 20 74 68 65 20 6e 65 78 74 20 6c 69 6e 65 3a 0a
0000112 30 31 32 33 34 35 36 37 38 39 0a 47 6f 6f 64 2d
0000128 62 79 65 2e 0a
0000133
[root@instructor shared]# od -Ad -tx1z dumpme 
0000000 48 65 6c 6c 6f 2e 0a 54 68 65 20 77 68 6f 6c 65  >Hello..The whole<
0000016 20 61 6c 70 68 61 62 65 74 20 69 73 20 6f 6e 20  > alphabet is on <
0000032 74 68 65 20 6e 65 78 74 20 6c 69 6e 65 3a 0a 41  >the next line:.A<
0000048 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51  >BCDEFGHIJKLMNOPQ<
0000064 52 53 54 55 56 57 58 59 5a 0a 41 6e 64 20 74 68  >RSTUVWXYZ.And th<
0000080 65 20 31 30 20 6e 75 6d 65 72 61 6c 73 20 6f 6e  >e 10 numerals on<
0000096 20 74 68 65 20 6e 65 78 74 20 6c 69 6e 65 3a 0a  > the next line:.<
0000112 30 31 32 33 34 35 36 37 38 39 0a 47 6f 6f 64 2d  >0123456789.Good-<
0000128 62 79 65 2e 0a                                   >bye..<
0000133
[root@instructor shared]# od -Ad -tu1 dumpme 
0000000  72 101 108 108 111  46  10  84 104 101  32 119 104 111 108 101
0000016  32  97 108 112 104  97  98 101 116  32 105 115  32 111 110  32
0000032 116 104 101  32 110 101 120 116  32 108 105 110 101  58  10  65
0000048  66  67  68  69  70  71  72  73  74  75  76  77  78  79  80  81
0000064  82  83  84  85  86  87  88  89  90  10  65 110 100  32 116 104
0000080 101  32  49  48  32 110 117 109 101 114  97 108 115  32 111 110
0000096  32 116 104 101  32 110 101 120 116  32 108 105 110 101  58  10
0000112  48  49  50  51  52  53  54  55  56  57  10  71 111 111 100  45
0000128  98 121 101  46  10
0000133
[root@instructor shared]#
[root@instructor shared]# 
[root@instructor shared]# od -Ad -tx1 mbr-assignment.img 
0000000 fa 33 c0 8e d0 bc 00 7c 8b f4 50 07 50 1f fb fc
0000016 bf 00 06 b9 00 01 f2 a5 ea 1d 06 00 00 be be 07
0000032 b3 04 80 3c 80 74 0e 80 3c 00 75 1c 83 c6 10 fe
0000048 cb 75 ef cd 18 8b 14 8b 4c 02 8b ee 83 c6 10 fe
0000064 cb 74 1a 80 3c 00 74 f4 be 8b 06 ac 3c 00 74 0b
0000080 56 bb 07 00 b4 0e cd 10 5e eb f0 eb fe bf 05 00
0000096 bb 00 7c b8 01 02 57 cd 13 5f 73 0c 33 c0 cd 13
0000112 4f 75 ed be a3 06 eb d3 be c2 06 bf fe 7d 81 3d
0000128 55 aa 75 c7 8b f5 ea 00 7c 00 00 49 6e 76 61 6c
0000144 69 64 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62
0000160 6c 65 00 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67
0000176 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 65
0000192 6d 00 4d 69 73 73 69 6e 67 20 6f 70 65 72 61 74
0000208 69 6e 67 20 73 79 73 74 65 6d 00 00 00 00 00 00
0000224 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000432 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
0000448 01 00 06 1f 3f 20 3f 00 00 00 a1 03 01 00 00 00
0000464 01 21 83 1f 7f 07 e0 03 01 00 20 1b 07 00 00 00
0000480 41 08 82 1f 7f 11 00 1f 08 00 c0 4e 00 00 80 00
0000496 41 12 07 1f bf 07 c0 6d 08 00 40 91 07 00 55 aa
0000512
[root@instructor shared]# od -Ad -tx1z mbr-assignment.img 
0000000 fa 33 c0 8e d0 bc 00 7c 8b f4 50 07 50 1f fb fc  >.3.....|..P.P...<
0000016 bf 00 06 b9 00 01 f2 a5 ea 1d 06 00 00 be be 07  >................<
0000032 b3 04 80 3c 80 74 0e 80 3c 00 75 1c 83 c6 10 fe  >...<.t..<.u.....<
0000048 cb 75 ef cd 18 8b 14 8b 4c 02 8b ee 83 c6 10 fe  >.u......L.......<
0000064 cb 74 1a 80 3c 00 74 f4 be 8b 06 ac 3c 00 74 0b  >.t..<.t.....<.t.<
0000080 56 bb 07 00 b4 0e cd 10 5e eb f0 eb fe bf 05 00  >V.......^.......<
0000096 bb 00 7c b8 01 02 57 cd 13 5f 73 0c 33 c0 cd 13  >..|...W.._s.3...<
0000112 4f 75 ed be a3 06 eb d3 be c2 06 bf fe 7d 81 3d  >Ou...........}.=<
0000128 55 aa 75 c7 8b f5 ea 00 7c 00 00 49 6e 76 61 6c  >U.u.....|..Inval<
0000144 69 64 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62  >id partition tab<
0000160 6c 65 00 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67  >le.Error loading<
0000176 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 65  > operating syste<
0000192 6d 00 4d 69 73 73 69 6e 67 20 6f 70 65 72 61 74  >m.Missing operat<
0000208 69 6e 67 20 73 79 73 74 65 6d 00 00 00 00 00 00  >ing system......<
0000224 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
*
0000432 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01  >................<
0000448 01 00 06 1f 3f 20 3f 00 00 00 a1 03 01 00 00 00  >....? ?.........<
0000464 01 21 83 1f 7f 07 e0 03 01 00 20 1b 07 00 00 00  >.!........ .....<
0000480 41 08 82 1f 7f 11 00 1f 08 00 c0 4e 00 00 80 00  >A..........N....<
0000496 41 12 07 1f bf 07 c0 6d 08 00 40 91 07 00 55 aa  >A......m..@...U.<
0000512
[root@instructor shared]#