QCOW Image Format
From Forensics Wiki
Revision as of 05:54, 23 October 2011 by Joachim Metz (Talk | contribs)
QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.
Contents |
MIME types
File signature
QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")
File types
Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.
Contents
The QCOW format is used to store storage media data, e.g. disk images.
The QCOW image file consists of:
- the file header
- the L1 table (cluster aligned)
- the reference count table (cluster aligned)
- reference count blocks
- snapshot headers (8-byte aligned on cluster boundary)
- clusters containing:
- L2 tables
- storage media data
The clusters are 512 bytes of size
Encryption
The QCOW2 format supports optional AES encryption