Difference between revisions of "QCOW Image Format"
From ForensicsWiki
Joachim Metz (Talk | contribs) (→Contents) |
Joachim Metz (Talk | contribs) (→File types) |
||
| Line 7: | Line 7: | ||
== File types == | == File types == | ||
| − | Currently there are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format. | + | Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format. |
== Contents == | == Contents == | ||
Revision as of 15:32, 2 January 2011
QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.
MIME types
File signature
QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")
File types
Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.
Contents
The QCOW format is used to store storage media data, e.g. disk images.
The QCOW image file consists of:
- the file header
- the L1 table (cluster aligned)
- the reference count table (cluster aligned)
- reference count blocks
- snapshot headers (8-byte aligned on cluster boundary)
- clusters containing:
- L2 tables
- storage media data
The clusters are 512 bytes of size
Encryption
The QCOW2 format supports optional AES encryption
