ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "QCOW Image Format"

From ForensicsWiki
Jump to: navigation, search
(File types)
(Contents)
Line 10: Line 10:
  
 
== Contents ==
 
== Contents ==
The QCOW format is used to store a disk image.
+
The QCOW format is used to store storage media data, e.g. disk images.
 +
 
 +
The QCOW image file consists of:
 +
* the file header
 +
* the L1 table (cluster aligned)
 +
* the reference count table (cluster aligned)
 +
* reference count blocks
 +
* snapshot headers (8-byte aligned on cluster)
 +
* clusters containing:
 +
** L2 tables
 +
** storage media data
  
 
== Encryption ==
 
== Encryption ==

Revision as of 14:50, 31 December 2010

QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.

MIME types

File signature

QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")

File types

Currently there are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.

Contents

The QCOW format is used to store storage media data, e.g. disk images.

The QCOW image file consists of:

  • the file header
  • the L1 table (cluster aligned)
  • the reference count table (cluster aligned)
  • reference count blocks
  • snapshot headers (8-byte aligned on cluster)
  • clusters containing:
    • L2 tables
    • storage media data

Encryption

The QCOW2 format supports optional AES encryption

See also