LearnLinux › LearnLinux › CMDS

od - Octal Dump

Dump Files in Various Formats

About od

The od (octal dump) command is a powerful Unix/Linux utility that displays file contents in various formats including octal, hexadecimal, decimal, and ASCII. It's essential for examining binary files, debugging file formats, inspecting special characters, and analyzing raw data structures.

Common Use Cases:

  • Examining binary executables and data files
  • Finding hidden or special characters in text files
  • Debugging file format issues
  • Analyzing network packet captures
  • Inspecting configuration files for non-printing characters
  • Converting between different number bases
  • Verifying file integrity and structure
Common Options Reference
Option Description
-A [doxn] Address base: d=decimal, o=octal, x=hexadecimal, n=none
-t [acdoux] Output format: a=named chars, c=ASCII, d=decimal, o=octal, u=unsigned, x=hex
-N [bytes] Limit output to specified number of bytes
-j [bytes] Skip specified number of bytes before dumping
-w[bytes] Output specified number of bytes per line
-v Show all data (don't use * for repeated lines)
-c Character display (equivalent to -t c)
-x Hexadecimal 2-byte display (equivalent to -t x2)
Detailed Examples

Example 1Basic Octal Dump

Display a file in traditional octal format (default behavior):

$ echo "Hello World" > test.txt $ od test.txt
0000000 062510 066154 020157 067527 066162 005144 0000014

Explanation:

  • First column shows byte offset in octal (0000000 = byte 0)
  • Following columns show 2-byte words in octal format
  • 062510 = "He" (H=110 octal, e=145 octal, little-endian: 145 110)
  • Final line (0000014) shows total bytes (12 decimal = 014 octal)
  • Default behavior groups bytes as 16-bit words
Tip: The default octal format is less commonly used today. Most users prefer hexadecimal (-x) or character (-c) formats for better readability.

Example 2Hexadecimal Display

Display file contents in hexadecimal format with ASCII sidebar:

$ od -A x -t x1z test.txt
000000 48 65 6c 6c 6f 20 57 6f 72 6c 64 0a >Hello World.< 00000c

Explanation:

  • -A x: Show addresses in hexadecimal
  • -t x1: Display bytes as 1-byte hexadecimal values
  • z: Add ASCII representation in the right column
  • 48 = 'H', 65 = 'e', etc. in ASCII hex values
  • 0a = newline character
  • The > < markers show the ASCII interpretation
Note: This format is similar to hexdump -C and is excellent for examining binary files where you need to see both hex values and their ASCII equivalents.

Example 3Character Display with Special Characters

Display file showing special and control characters by name:

$ printf "Hello\tWorld\n\x00\x01\x02" > special.txt $ od -A d -c special.txt
0000000 H e l l o \t W o r l d \n \0 001 002 0000015

Explanation:

  • -A d: Show addresses in decimal
  • -c: Display characters with special char names
  • \t: Tab character (ASCII 9)
  • \n: Newline character (ASCII 10)
  • \0: Null character (ASCII 0)
  • 001, 002: Control characters shown in octal
  • Printable characters shown as-is
Tip: This format is ideal for debugging files that contain hidden control characters, tabs, or null bytes that cause problems in text processing.

Example 4Decimal Byte Values

Display file contents as unsigned decimal byte values:

$ echo "ABC" > decimal.txt $ od -A n -t u1 -w1 decimal.txt
65 66 67 10

Explanation:

  • -A n: Don't show address offsets
  • -t u1: Display as unsigned 1-byte decimal values
  • -w1: Show one byte per line
  • 65 = 'A', 66 = 'B', 67 = 'C' in ASCII decimal
  • 10 = newline character
  • Useful for converting characters to decimal codes
Note: This format is excellent for creating lookup tables or when you need decimal ASCII values for programming purposes.

Example 5Multiple Format Display

Display the same data in multiple formats simultaneously:

$ echo "Test" > multi.txt $ od -A x -t x1 -t c multi.txt
000000 54 65 73 74 0a 000000 T e s t \n 000005

Explanation:

  • First -t x1: Shows hexadecimal byte values
  • Second -t c: Shows character representation
  • Both formats use the same address offsets
  • 54 65 73 74 = "Test" in hex
  • Allows quick cross-referencing between formats
  • Can combine as many -t options as needed
Tip: Multiple format display is invaluable when reverse-engineering file formats or debugging binary protocols where you need to see the data from different perspectives.

Example 6Examining Specific Byte Ranges

Skip to a specific location and dump a limited number of bytes:

$ dd if=/dev/urandom of=random.bin bs=1 count=100 2>/dev/null $ od -A x -t x1 -j 20 -N 16 random.bin
000014 3f a2 c5 89 12 4e 7b d1 90 5f 23 e8 44 b9 76 03 000024

Explanation:

  • -j 20: Skip first 20 bytes (jump)
  • -N 16: Read only 16 bytes after skip
  • Address starts at 000014 (hex) = 20 (decimal)
  • Ends at 000024 (hex) = 36 (decimal) = 20+16
  • Useful for examining specific sections of large files
  • Avoids loading entire file into memory
Note: This is extremely useful for examining file headers, magic numbers, or specific data structures in large binary files without processing the entire file.

Example 7Finding Hidden Characters in Text Files

Detect problematic whitespace and control characters:

$ printf "Line1\r\nLine2\t \nLine3" > problematic.txt $ od -A n -c problematic.txt
L i n e 1 \r \n L i n e 2 \t \n L i n e 3

Explanation:

  • \r\n: Windows-style line ending (CR+LF)
  • \t: Tab character followed by spaces
  • \n: Unix-style line ending (LF only)
  • Reveals invisible formatting issues
  • Critical for debugging cross-platform text issues
  • Shows exact whitespace differences
Warning: Mixed line endings (CR+LF vs LF) and trailing whitespace are common sources of bugs in scripts and configuration files. Use od to identify these issues quickly.

Example 8Examining Binary File Headers

Inspect magic numbers and file format identifiers:

$ od -A x -t x1z -N 32 /bin/ls
000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 >.ELF............< 000010 03 00 3e 00 01 00 00 00 40 6b 00 00 00 00 00 00 >..>.....@k......< 000020

Explanation:

  • First 4 bytes: 7f 45 4c 46 = ELF magic number
  • 45 4c 46 = "ELF" in ASCII
  • Byte 4 (02): 64-bit format
  • Byte 5 (01): Little-endian encoding
  • Byte 6 (01): Current ELF version
  • -N 32: Only examine first 32 bytes
  • All Linux executables start with this ELF header
Tip: Common file magic numbers: PNG (89 50 4e 47), PDF (25 50 44 46), GZIP (1f 8b), JPEG (ff d8 ff). Use od to verify file types when extensions are missing or incorrect.

Example 9Comparing File Differences at Byte Level

Identify exact byte-level differences between similar files:

$ echo "Hello World" > file1.txt $ echo "Hello Warld" > file2.txt $ diff <(od -A x -t x1 file1.txt) <(od -A x -t x1 file2.txt)
1c1 < 000000 48 65 6c 6c 6f 20 57 6f 72 6c 64 0a --- > 000000 48 65 6c 6c 6f 20 57 61 72 6c 64 0a

Explanation:

  • Process substitution feeds od output to diff
  • Byte 7: 6f (o) vs 61 (a) - the difference
  • "World" vs "Warld" difference clearly visible
  • Hexadecimal comparison shows exact byte change
  • More precise than text diff for binary files
  • Useful for detecting subtle corruption or modifications
Note: For pure binary file comparison, consider using cmp -l which shows only the differing bytes, or xxd with diff for a more visual side-by-side comparison.

Example 10Creating a Hex Dump for Documentation

Generate a clean, formatted hex dump suitable for documentation or reports:

$ echo "SAMPLE DATA" > sample.txt $ od -A x -t x1 -w16 -v sample.txt
000000 53 41 4d 50 4c 45 20 44 41 54 41 0a 00000c

Explanation:

  • -A x: Hex addresses for consistency
  • -t x1: Single-byte hex values
  • -w16: Exactly 16 bytes per line (standard width)
  • -v: Show all data (no asterisk abbreviations)
  • Creates consistent, predictable output format
  • Ideal for technical documentation or bug reports
  • Easy to copy/paste and annotate
Tip: For professional-looking hex dumps with ASCII sidebar, combine with: od -A x -t x1z -w16 -v filename. This format is widely recognized and easy to read in technical documentation.
Related Commands and Tools

Similar Commands Worth Knowing

  • hexdump - More flexible hex dump utility with better formatting options; hexdump -C file provides canonical hex+ASCII output
  • xxd - Make hexdump or reverse; excellent for creating/restoring binary files from hex; includes reverse operation
  • strings - Extract printable strings from binary files; useful for finding text in executables
  • hd - Alias for hexdump; same functionality with shorter command name
  • hexedit - Interactive hex editor; allows editing binary files in place
  • bvi - Binary visual editor; vi-like interface for binary files
  • cmp - Compare binary files byte by byte; use cmp -l to show all differences
  • file - Determine file type using magic numbers; often used before od to identify format
Common Pitfalls and Solutions
Pitfall 1: Default Octal Format Confusion

The default octal output is counterintuitive. Most users expect hex.

Solution: Always use -t x1 or -x for hexadecimal output, which is more commonly understood.

Pitfall 2: Repeated Lines Hidden

By default, od uses asterisk (*) to indicate repeated identical lines, hiding data.

Solution: Use -v flag to show all data without abbreviation: od -v file

Pitfall 3: Byte Ordering (Endianness)

Multi-byte formats may show bytes in reverse order due to endianness.

Solution: Use single-byte formats (-t x1) to avoid confusion, or understand your system's endianness.

Pitfall 4: Large File Memory Usage

Running od on huge files without limits can be slow.

Solution: Use -N to limit bytes read, or -j to skip to relevant sections: od -N 1024 largefile

Pro Tips and Best Practices
Tip 1: Quick File Type Verification

Check file magic numbers to verify file types:

od -A n -t x1 -N 4 file.png | head -1

Should show: 89 50 4e 47 for valid PNG files

Tip 2: Debugging Character Encoding Issues

When text displays incorrectly, check the actual byte values:

od -A n -t x1 problematic.txt | grep -E "[8-9a-f][0-9a-f]"

High bit set (80-FF) indicates non-ASCII encoding (UTF-8, Latin-1, etc.)

Tip 3: Creating Test Data

Use od with xxd -r to create binary test files from hex dumps:

echo "48 65 6c 6c 6f" | xxd -r -p > hello.bin
Tip 4: Examining Core Dumps

Inspect program memory dumps at specific addresses:

od -A x -t x4 -j $((0x1000)) -N 64 core

Useful for debugging segmentation faults and memory corruption

Tip 5: Network Protocol Analysis

When examining captured network packets:

tcpdump -w capture.pcap od -A x -t x1z -N 64 capture.pcap

First 24 bytes are pcap file header, followed by packet data

Historical Note: The od command dates back to AT&T Unix Version 1 (1971). Its name reflects the original emphasis on octal notation, which was more common in early computing. While hexadecimal has become the standard, od remains a essential tool for systems administrators and developers working with binary data.
Quick Reference Cheat Sheet
Task Command
Basic hex dump with ASCII od -A x -t x1z file
Show special characters od -c file
Decimal byte values od -A n -t u1 file
Skip and limit bytes od -j 100 -N 50 file
16 bytes per line, all data od -A x -t x1 -w16 -v file
Check file magic number od -A n -t x1 -N 4 file
Multiple format display od -A x -t x1 -t c file
Standard hex dump format od -A x -t x1z -w16 -v file