I tried to extract the Master Boot Record (MBR) via mmcat.exe in PowerShell and PowerShell ISE (Version 5.1.1). The outputted binary data is always bigger than 512 bytes. PowerShell 6.1.1 has still this problem.
$mmcat = "C:\Tools\sleuthkit\bin\mmcat.exe"
& $mmcat -t dos "$EWF_IMAGE" 0 > "$OUTPUT\Disk-Geometry\MBR.bin"
The issue is well decribed here: PowerShell’s Object Pipeline Corrupts Piped Binary Data
Do you know a workaround for this?
>uses default UTF encoding. Did you try& $mmcat -t dos "$EWF_IMAGE" 0 | "$OUTPUT\Disk-Geometry\MBR.bin" -encoding Ascii?-NoNewLine