How to view the content of a hard disk in hexadecimal by byte from the bottom layer on the Mac terminal (use dd and hexdump to realize the function of winhex, so other systems can also use this method)

First of all, it needs to be emphasized: this method cannot guarantee that all hard disks can be viewed. Some hard disks will display "Resource busy" due to some reasons, such as time machine hard disks, built-in hard disks, etc.

Prepare:

1. A Mac of course;
2. hexdumpprogram
3. ddprogram

Methods as below:

$ sudo dd if=/dev/disk4 count=100000 | hexdump -C > disk.txt

Here are some explanations:

1. It must be used sudoto obtain permissions, otherwise the hard disk files cannot be viewed, which is different from some Linux distributions.
2. ddIt is a program that is often used to copy hard disks and systems at the byte level, so we can use this for output.
3. if=/dev/disk4is the directory of the input file, here /dev/disk4is the hard disk we want to check. One thing to note: you must check the hard disk , not a certain partition. If you can't tell the difference, please see the "Extended Knowledge" section of my other blog "How to use terminal commands to mount and unmount an external hard drive on macOS (diskutil command usage and APFS format exploration)" .
4. count=100000It means to output 100000 blocks, if you just want to see some information of the file system, then only 1000 is almost enough.
5. After the output, it needs hexdump -Cto be interpreted. hexdumpIt is a program for viewing files in hexadecimal on a terminal, -Cand the corresponding characters will be displayed on the right.
6. > disk.txtThe result will be output into a disk.txtfile named , which is convenient for us to view.

Other systems can also use this method, the difference lies in the path of the hard disk device, Linux is generally in /mnt/the directory.

Hope to help those in need~