Question

Is there any tool to aid in analyzing an unknown hex dump (to find possible datatypes).

What i have is a string, which is a dump of some hex network data. The network data is NOT regular network data, so wirehsark wont be able to identify.

I need a tool that can help me parse the hex and fine the datatypes within.

The hex dump that i do have could look like this:
00 00 00 00 04 B4 FD 43 90 88 BA 44 06 A3 30 C4 00 00 00 00 CE 3B 54 BF 44 27 0F 3F 00 00 00 00 02 00

Answer 1

You can try to convert these hexdumps to regular binary files. There is a tool for this called xxd, see http://linuxcommand.org/man_pages/xxd1.html

You can also convert using custom script. With PHP it could be:

<?php
$in = fopen("input", "rt");
$out = fopen("output", "wb");
while ($line = fgets($in)) {
  foreach (explode(" ", $line) as $number) {
    fwrite($out, chr(hexdec($number)));
  }
}

Then you use classic data recovery tools and scan these binary files for datatypes:

• Scalpel
• PhotoRec (for multiple platforms)
• Foremost