Forensicshexeditorncursesforensicsfileeditor

shed

shed is a simple hex editor with a pico-style interface for viewing and editing files in text mode using ncurses. It supports multiple display formats and is useful in forensics investigations.

Description

shed (Simple Hex Editor) is an easy application for viewing and editing files in text mode, using ncurses. The main features include displaying each byte as ASCII, hex, decimal, octal, and binary; allowing changes to be input in all displayed modes with bit toggling in the binary column; a simple Pico-style interface; search resource; dumping information to file; small memory requirements since the file is not loaded into memory; and large file support.

shed is useful in forensics investigations where precise editing and viewing of binary data is required without loading large files entirely into memory. Its ncurses-based interface makes it suitable for terminal environments, providing an intuitive experience similar to the Pico editor.

The tool supports device files and offers options for readonly mode, starting at specific offsets, hex offsets, and setting lengths, enhancing its utility for targeted analysis.

How It Works

shed operates using ncurses for a text-mode interface, displaying file bytes in ASCII, hex, decimal, octal, and binary formats without loading the entire file into memory to support large files and minimize resource usage. Edits are applied directly with support for input in all display modes and bit toggling in binary view; it includes search functionality and can dump data to files.

Installation

bash
sudo apt install shed

Flags

-r / --readonlyopen FILE read only
-s / --start=OFFSETposition cursor to offset
-H / --hexstart with hex offsets
-L / --lengthset length (for device files)
-h / --helpshow help and exit
-v / --versionshow version and exit

Examples

Show help and exit
shed -h
Show version and exit
shed -v
Open example.bin file in default hex editor mode
shed example.bin
Open example.bin file in read-only mode
shed -r example.bin
Open example.bin and position cursor to offset 0x100
shed -s 0x100 example.bin
Open example.bin starting with hex offsets
shed -H example.bin
Open device file /dev/sda with length set to 1024 bytes
shed -L 1024 /dev/sda
Open interactive hex editor without a specific file
shed
Updated 2026-04-16kali.org ↗