CODEWITHSUNDEEP
powershell
user3022917
user3022917

Reputation: 611

How to pipe binary data in PowerShell

I tried to extract the Master Boot Record (MBR) via mmcat.exe in PowerShell and PowerShell ISE (Version 5.1.1). The outputted binary data is always bigger than 512 bytes. PowerShell 6.1.1 has still this problem.

$mmcat = "C:\Tools\sleuthkit\bin\mmcat.exe"
& $mmcat -t dos "$EWF_IMAGE" 0 > "$OUTPUT\Disk-Geometry\MBR.bin"

The issue is well decribed here: PowerShell’s Object Pipeline Corrupts Piped Binary Data

Do you know a workaround for this?

Upvotes: 12

Views: 3085

Answers (2)

dns
dns

Reputation: 2815

PowerShell 7 support -AsByteStream to pipe binary data:

Get-Content -AsByteStream .\original.bin | Set-Content -AsByteStream .\copied-file.bin

If you want to concatenate binary file use Add-Content:

Get-Content -AsByteStream .\original.bin | Add-Content -AsByteStream .\appended-file.bin

Upvotes: 5

SATO Yusuke
SATO Yusuke

Reputation: 2184

You can't pipe binary data in PowerShell. To work around, use cmd.exe like this:

$command = "C:\Tools\sleuthkit\bin\mmcat.exe -t dos `"$EWF_IMAGE`" 0 > `"$OUTPUT\Disk-Geometry\MBR.bin`""
cmd /c $command

You can read binary data like this:

[byte[]]$mbr = Get-Content -Path $OUTPUT\Disk-Geometry\MBR.bin -Encoding Byte

Upvotes: 2

Related Questions