13

I tried to extract the Master Boot Record (MBR) via mmcat.exe in PowerShell and PowerShell ISE (Version 5.1.1). The outputted binary data is always bigger than 512 bytes. PowerShell 6.1.1 has still this problem.

$mmcat = "C:\Tools\sleuthkit\bin\mmcat.exe"
& $mmcat -t dos "$EWF_IMAGE" 0 > "$OUTPUT\Disk-Geometry\MBR.bin"

The issue is well decribed here: PowerShell’s Object Pipeline Corrupts Piped Binary Data

Do you know a workaround for this?

11
  • > uses default UTF encoding. Did you try & $mmcat -t dos "$EWF_IMAGE" 0 | "$OUTPUT\Disk-Geometry\MBR.bin" -encoding Ascii ? Commented Jan 8, 2019 at 6:59
  • I tested it one minute ago...the output is 514 bytes. I tested also earlier -Encoding oem. Commented Jan 8, 2019 at 7:14
  • Try adding -NoNewLine Commented Jan 8, 2019 at 7:40
  • I played with -NoNewLine and -Encoding ascii & -Encoding oem...when the output has 512 bytes...for example the MBR Signature (55 AA) at the end is wrong. Commented Jan 8, 2019 at 7:59
  • 1
    For posterity (because I constantly re-google the github issue) here is the open ticket Commented Nov 5, 2022 at 3:32

2 Answers 2

4

PowerShell 7 support -AsByteStream to pipe binary data:

Get-Content -AsByteStream .\original.bin | Set-Content -AsByteStream .\copied-file.bin

If you want to concatenate binary file use Add-Content:

Get-Content -AsByteStream .\original.bin | Add-Content -AsByteStream .\appended-file.bin
Sign up to request clarification or add additional context in comments.

3 Comments

PS 5 has get-content -encoding byte
@js2010 The future PowerShell version will not support -Encoding Byte. It's replaced by -AsByteStream
The question title is how to pipe binary data. This works when you want to output to a file but I can't get it to work for piping to another program for example
2

You can't pipe binary data in PowerShell. To work around, use cmd.exe like this:

$command = "C:\Tools\sleuthkit\bin\mmcat.exe -t dos `"$EWF_IMAGE`" 0 > `"$OUTPUT\Disk-Geometry\MBR.bin`""
cmd /c $command

You can read binary data like this:

[byte[]]$mbr = Get-Content -Path $OUTPUT\Disk-Geometry\MBR.bin -Encoding Byte

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.