Difference between revisions of "QCOW Image Format"

From ForensicsWiki
Jump to: navigation, search
(Contents)
(File types)
Line 7: Line 7:
  
 
== File types ==
 
== File types ==
Currently there are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.
+
Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.
  
 
== Contents ==
 
== Contents ==

Revision as of 14:32, 2 January 2011

QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.

MIME types

File signature

QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")

File types

Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.

Contents

The QCOW format is used to store storage media data, e.g. disk images.

The QCOW image file consists of:

  • the file header
  • the L1 table (cluster aligned)
  • the reference count table (cluster aligned)
  • reference count blocks
  • snapshot headers (8-byte aligned on cluster boundary)
  • clusters containing:
    • L2 tables
    • storage media data

The clusters are 512 bytes of size

Encryption

The QCOW2 format supports optional AES encryption

See also