To use HxD:
- Download the HxD tool.
- Run HxD.exe as the Administrator.
-
Click on the Extras tab and select Open disk... to access the disk that is connected to your PC.
Click image to enlarge.
-
On the Open disk window, under Physical disks, select the correct disk you want to extract sectors from. Make sure that the Open as Readonly box is checked.
Click image to enlarge.
-
HxD will initially show Sector 0 of a disk drive, this is the beginning of the MBR sector on a hard disk.
Click image to enlarge.
-
Select the sectors to copy by clicking the Edit tab then click Select Block...
Click image to enlarge.
-
For every sector there are 512 bytes. On the Select block window, for Start-offset put in "0". Select dec and put in "32256" for the Length. Click OK.
Click image to enlarge.
512 bytes/sector multiplied by 63 sectors equals 32256 bytes. We usually need to select Track0 which is the first 63 sectors. If you are asked to select a different number of sectors, use the same equation. - Right-click on the highlighted sectors then click Copy.
- Click on the File tab and choose New to start a new file.
- Paste the sectors to this new file by clicking on the Edit tab then select Paste. Click OK when asked to confirm. The new data will be in red to indicate that it has not yet been saved.
- Click on the File tab and choose Save as... Type in a File name then put .BIN as the extension. Click on Save.
- Submit this file to Trend Micro Technical Support for analysis.