I tried to extract the Master Boot Record (MBR) via mmcat.exe in PowerShell and PowerShell ISE (Version 5.1.1). The outputted binary data is always bigger than 512 bytes. PowerShell 6.1.1 has still this problem.
$mmcat = "C:\Tools\sleuthkit\bin\mmcat.exe"
& $mmcat -t dos "$EWF_IMAGE" 0 > "$OUTPUT\Disk-Geometry\MBR.bin"
The issue is well decribed here: PowerShell’s Object Pipeline Corrupts Piped Binary Data
Do you know a workaround for this?
PowerShell 7 support -AsByteStream to pipe binary data:
Get-Content -AsByteStream .\original.bin | Set-Content -AsByteStream .\copied-file.bin
If you want to concatenate binary file use Add-Content:
Get-Content -AsByteStream .\original.bin | Add-Content -AsByteStream .\appended-file.bin
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With