Linux tip: How to use the od command

Hi, this is Sandra Henry-Stocker, author of the “Unix as a Second Language” blog on Network World.
In today’s Linux tip, we’re going to look at the od command – a command that allows you to look at the content of files. If you’re thinking “Wait, I can do that with cat or more” well, yes, you can look at text files with cat and more, but what about image files and executable files? If you want to look at the content of those files, check out od.
The name “od” stands for “octal dump”, but od’s more flexible than the name suggests. It allows you to display the contents of files in a number of formats. Let’s look at an example.
Say I want to look inside a png or a jpg file. I could use a command like this:
$ od -bc penguin.png | head -12
0000000 211 120 116 107 015 012 032 012 000 000 000 015 111 110 104 122
211 P N G \r \n 032 \n \0 \0 \0 \r I H D R
0000020 000 000 000 306 000 000 000 376 010 006 000 000 000 141 262 172
\0 \0 \0 306 \0 \0 \0 376 \b 006 \0 \0 \0 a 262 z
0000040 235 000 000 046 346 172 124 130 164 122 141 167 040 160 162 157
235 \0 \0 & 346 z T X t R a w p r o
0000060 146 151 154 145 040 164 171 160 145 040 145 170 151 146 000 000
f i l e t y p e e x i f \0 \0
0000100 170 332 255 234 151 226 134 071 156 205 377 163 025 136 002 011
x 332 255 234 i 226 \ 9 n 205 377 s 025 ^ 002 \t
0000120 316 313 341 170 216 167 340 345 373 273 214 220 112 122 127 367
316 313 341 x 216 w 340 345 373 273 214 220 J R W 367
Intrigued? Seriously, this is pretty interesting. Notice the string “PNG” near the beginning of the second line? That identifies this file as a png file. Every png file will have this identifier.
It’s important to understand that the output here shows two lines for every 16 bytes in the file. The first, third and fifth lines, etc. are showing us the data in octal; the second, fourth and sixth, etc. show the character interpretations when the values correspond to ASCII characters. If you look further down, you’ll see the string “Raw profile type exif” – another bit of information that describes the kind of file we’re looking at. Most of the rest of the file contains the data that comprises the image organized as a series of “chunks”. Each chunk contains the length of the chunk, the chunk type, the chunk data and a CRC (cyclic redundancy check) value that can be used to verify that the chunk is valid.
If you look at an executable – a file that corresponds to a Linux command – you’re going to see something like this:
$ od -bc /bin/echo | head -4
0000000 177 105 114 106 002 001 001 000 000 000 000 000 000 000 000 000
177 E L F 002 001 001 \0 \0 \0 \0 \0 \0 \0 \0 \0
0000020 003 000 076 000 001 000 000 000 120 034 000 000 000 000 000 000
003 \0 > \0 001 \0 \0 \0 P 034 \0 \0 \0 \0 \0 \0
In this example, we see “ELF” as the file type identifier (executable and linkable format).
You can use od to look at text files too, but this is seldom useful unless you just want to see how the letters look in octal.
$ od -bc hello
0000000 110 145 154 154 157 054 040 127 157 162 154 144 041 012
H e l l o , W o r l d ! \n
0000016
That’s your 2-minute Linux tip for today. If you liked this video, please hit the like and share buttons. For more Linux tips, be sure to follow us on Facebook, Youtube and NetworkWorld.com.