Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to run something like

% sudo grep -i -a 'some-string' <drive device>

On Linux, <drive device> would be something like /dev/sda1. How can I find the equivalent on Darwin?

(In case it's not obvious, I'm on a last-ditch-effort hunt for accidentally deleted data.)

share|improve this question
up vote 5 down vote accepted

If the filesystem takes over the whole disk, OS X currently uses a name like /dev/disk5. If the disk is partitioned, it adds an s# suffix, like /dev/disk5s2 for the second partition. (s is short for "slice," a BSDism functionally equivalent to a partition.)

Disks are numbered sequentially in discovery order by the OS, on boot, so you may have to experiment a bit to figure out which device is which.

If you say diskutil list at the command line, you get a detailed list of available disks, including their /dev nodes and volume names:

   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage                         121.0 GB   disk0s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk0s3
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Time Machine           *999.5 GB   disk7

In the case of disk0 above, there are three slices on the disk, so there is a /dev/disk0 for the whole disk, plus /dev/disk0s1 through ...s3.

In the case of disk7, there are no slices reported, so you would access that one through the whole-disk /dev/disk7 node.

share|improve this answer

When grepping a disk - unless you're actually looking for non-printable information - you might like to do:

tr -c '[:print:]\n' '\n\n' </dev/disk |
grep -b 'regex' 

All binary data is converted to newlines and grep can simply ignore it except to increment the offset it reports on by one.

share|improve this answer
It's a neat trick, but it doesn't actually answer the question. – Warren Young Aug 26 '14 at 2:33
@WarrenYoung - very true. More useful as an aside. I honestly don't know how Apple does it, and don't expect it to be accepted or even upvoted. It's just... help, you know? – mikeserv Aug 26 '14 at 2:55
@WarrenYoung - by the way - if you wanted to put it in your answer, which does answer the question, I'd happily delete this. – mikeserv Aug 26 '14 at 3:01
Better idea: ask a question to which this is the answer. Then you get points for being clever. :) – Warren Young Aug 26 '14 at 3:40

I noticed a few gotchas when grepping disk devices which I noted here with a helper script:


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.