shed
shed is a simple hex editor with a pico-style interface for viewing and editing files in text mode using ncurses. It supports multiple display formats and is useful in forensics investigations.
Description
shed (Simple Hex Editor) is an easy application for viewing and editing files in text mode, using ncurses. The main features include displaying each byte as ASCII, hex, decimal, octal, and binary; allowing changes to be input in all displayed modes with bit toggling in the binary column; a simple Pico-style interface; search resource; dumping information to file; small memory requirements since the file is not loaded into memory; and large file support.
shed is useful in forensics investigations where precise editing and viewing of binary data is required without loading large files entirely into memory. Its ncurses-based interface makes it suitable for terminal environments, providing an intuitive experience similar to the Pico editor.
The tool supports device files and offers options for readonly mode, starting at specific offsets, hex offsets, and setting lengths, enhancing its utility for targeted analysis.
How It Works
shed operates using ncurses for a text-mode interface, displaying file bytes in ASCII, hex, decimal, octal, and binary formats without loading the entire file into memory to support large files and minimize resource usage. Edits are applied directly with support for input in all display modes and bit toggling in binary view; it includes search functionality and can dump data to files.
Installation
sudo apt install shedFlags
Examples
shed -hshed -vshed example.binshed -r example.binshed -s 0x100 example.binshed -H example.binshed -L 1024 /dev/sdashed