Difference between revisions of "QCOW Image Format"

From ForensicsWiki
Jump to: navigation, search
(File types)
(Contents)
Line 10: Line 10:
  
 
== Contents ==
 
== Contents ==
The QCOW format is used to store a disk image.
+
The QCOW format is used to store storage media data, e.g. disk images.
 +
 
 +
The QCOW image file consists of:
 +
* the file header
 +
* the L1 table (cluster aligned)
 +
* the reference count table (cluster aligned)
 +
* reference count blocks
 +
* snapshot headers (8-byte aligned on cluster)
 +
* clusters containing:
 +
** L2 tables
 +
** storage media data
  
 
== Encryption ==
 
== Encryption ==

Revision as of 09:50, 31 December 2010

QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.

MIME types

File signature

QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")

File types

Currently there are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.

Contents

The QCOW format is used to store storage media data, e.g. disk images.

The QCOW image file consists of:

  • the file header
  • the L1 table (cluster aligned)
  • the reference count table (cluster aligned)
  • reference count blocks
  • snapshot headers (8-byte aligned on cluster)
  • clusters containing:
    • L2 tables
    • storage media data

Encryption

The QCOW2 format supports optional AES encryption

See also