How to use HxD as a
Disk Editor to save
Sectors as Binary Files


Copyright © 2013, 2016 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author!
(This is an authorized and edited copy of the > original page for mh-nexus.de.)


The steps below show how any 'user accessible data' (of 1 byte to about 1 Gigabyte[1]), can be saved to a binary file using the HxD hex/disk editor. Save a disk's MBR (Master Boot Record) or Volume Boot Sector, or copy many sectors (such as the first 100 or 2100). Data can be saved from an HDD (spinning hard disk drive), SSD (Solid State Drive - no moving parts), removable diskettes in a 'floppy drive', USB drives[2], a CD or DVD in an 'Optical drive'[3] or even from a PC's Memory.

Please Note: Unlike the Windows® XP OS, if you run HxD under Windows Vista, 7, 8 or later, you will need to explicitly grant it administrator privileges in order to even read data from a drive! So you must start the program as follows: 1) Right-click on "HxD.exe" or its Desktop icon, then choose "Run as administrator" 2) When asked to allow HxD to make changes; even though you will only read data from a drive, you must click on "Yes" in order to access your disk drives. Note: For reading and writing files from/to a logical drive (i.e., when using HxD as a simple file editor), you do not need to do either of these!


Figure 0.a
 

 

Figure 0.b ->

Note: If you like Keyboard Shortcuts, pressing an 'ALT' key will underline the shortcut keys in the menus.

How to Save Data from Storage Media to Binary Files

1. Open HxD's "Extras" menu and select "Open disk..." to access disks connected to your PC. (Note: clicking on the 'Open disk icon' circled in BLUE in Figure 1a below will do the same thing.) If you have many disks or partitions, it will take some time for HxD to access and examine them. An 'Open disk' window will eventually appear. You can choose either a "Logical" drives (Windows assigns 'letters' to logical drives) or "Physical disks" to open.

NOTE: For this exercise, choose 'Hard Disk 1' as shown here, making sure the "Open as Readonly" box is checked (so you will not accidentally write to your drive):


Figure 1.a
Use your mouse, or 'ALT + X' on keyboard to
choose a Logical or Physical disk to open.
Physical disk types begin with digit '1'.

2. HxD will always open at 'Sector 0' of a disk drive; here we see the beginning of an MBR sector on a 750 GB hard disk:


Figure 2.

Learning some basic controls. We encourage you to take some time observing what happens when you do the following:

3. Use 2. d) 1), 2) or 3) to be sure you're at 'Sector 0'. [No matter what kind of Windows or Linux OS boots-up from a disk drive, there should always be some kind of code and data in its first sector. And whether it's a 'Basic' or 'Dynamic' drive, or even GPT partitioned, the Partition Table should always have at least one entry to keep any MBR utility from 'thinking' the disk has not been partitioned!]

4. SELECT the bytes to copy: In step 2, you learned how to select bytes by dragging a 'mouse cursor' across them, but for a large number of sectors, it's best to use the "Select block..." window (in Figure 3 below) by simply pressing the "Control + E" keys to pop it up, or choose it from the "Edit" menu.

Figure 3. To Select the First 100 or 2100 Sectors of a Drive

In this pop-up window, make sure to:

a) Set this to "dec" (decimal); unless you'd rather use and multiply in hexadecimal.
b) Set "Start-offset: " to zero ("0"); if it didn't default to that.
c) Type "51200" (512 bytes per sector x 100 sectors) into the "Length: " box; you'll see the "End-offset" box automatically change to 51199; since offsets always begin with '0'.
d) Press the "OK" button.

To select 2100 sectors, in step c) above, type in "1075200" (512 bytes per sector x 2100 sectors). To select only the MBR Sector, type 512 in the 'Length' box.

5. To COPY the 'Selected' bytes, you only need to do one of the following:

6. To SAVE the copied bytes to a binary file, do the following:

7. Right-click on the TAB and close it. Check that the file was saved correctly to the folder you chose.

 

 


Footnotes

1[Return to Text] The amount of data that can be copied depends on how much free Memory is available. Even the commercial hex/disk editor, WinHex, has this limitation when attempting to copy data from one large file into another. If a PC is running a 32-bit OS and with 4 GiB of Memory installed, the amount of data that can be copied will probably be limited to roughly 1.5 GiB; assuming no other programs are running; it will also be less, depending upon whether any memory is used for an 'onboard video adapter' or other device(s). (Note: Although we have 4 GB of Memory installed; and we could have up to 8 GB, the Computer 'Properties' under our 32-bit Windows XP Pro OS shows it cannot access more than "3.24 GB of RAM".) So a limit of 1 Gigabyte seems a fair approximation for a 32-bit OS. For a 64-bit OS; especially if the PC has 6, 8 or even more GiB of Memory installed, this limitation will increase accordingly. WinHex and imaging programs, such as FTK Imager, use different methods when saving a whole disk drive (of hundreds of Gigabytes or a few Terabytes) to an image file!

2[Return to Text] USB (or 'Removable') drives are most often formatted as a single Volume, the first sector of the drive being its Volume Boot Sector; so no MBR sector (or partition table) exists on such a drive. This is also true for floppy diskettes. Microsoft® Windows™ generally does not allow removable drives to be partitioned. However, there are utilities available for partitioning USB drives, so it is possible to find an MBR sector and partition(s) on a removable drive. Of course, if you're using an IDE(or SATA)-to-USB Adapter with a disk drive, the drive may have already been partitioned. Figure 4 shows the beginning of a FAT32 formatted 8 GB USB drive:


Figure 4.

3[Return to Text] CD and DVD media usually have sectors of 2048 bytes each, with no readable data in the first 16 sectors.
  Figure 5 shows 'Sector 16' (the 17th sector) of an install CD for the Ubuntu Linux 10.04 LTS (64-bit) OS:


Figure 5.

This copy was created on March 27, 2016 (2016.03.27) by Daniel B. Sedory for Mal Hrz.