How to pipe binary data in PowerShell

user_3022917 0
Viewed 1167

I tried to extract the Master Boot Record (MBR) via mmcat.exe in PowerShell and PowerShell ISE (Version 5.1.1). The outputted binary data is always bigger than 512 bytes. PowerShell 6.1.1 has still this problem.

$mmcat = "C:\Tools\sleuthkit\bin\mmcat.exe"
& $mmcat -t dos "$EWF_IMAGE" 0 > "$OUTPUT\Disk-Geometry\MBR.bin"

The issue is well decribed here: PowerShell’s Object Pipeline Corrupts Piped Binary Data

Do you know a workaround for this?

powershell
2 Answers

PowerShell 7 support -AsByteStream to pipe binary data:

Get-Content -AsByteStream .\original.bin | Set-Content -AsByteStream .\copied-file.bin

If you want to concatenate binary file use Add-Content:

Get-Content -AsByteStream .\original.bin | Add-Content -AsByteStream .\appended-file.bin
user_23006140

You can't pipe binary data in PowerShell. To work around, use cmd.exe like this:

$command = "C:\Tools\sleuthkit\bin\mmcat.exe -t dos `"$EWF_IMAGE`" 0 > `"$OUTPUT\Disk-Geometry\MBR.bin`""
cmd /c $command

You can read binary data like this:

[byte[]]$mbr = Get-Content -Path $OUTPUT\Disk-Geometry\MBR.bin -Encoding Byte
user_39026630
Related