Difference between revisions of "QCOW Image Format"

From ForensicsWiki
Jump to: navigation, search
(File types)
(External Links)
(6 intermediate revisions by the same user not shown)
Line 27: Line 27:
The QCOW2 format supports optional AES encryption
The QCOW2 format supports optional AES encryption
== See also==
== See Also ==
* [[Disk Images]]
* [http://people.gnome.org/~markmc/qcow-image-format-version-1.html The QCOW Image Format]
== External Links ==
* [http://people.gnome.org/~markmc/qcow-image-format.html The QCOW2 Image Format]
* [http://people.gnome.org/~markmc/qcow-image-format-version-1.html The QCOW Image Format], by [[Mark McLoughlin]], June 2006
* [http://people.gnome.org/~markmc/qcow-image-format.html The QCOW2 Image Format], by [[Mark McLoughlin]], September 2008
* [https://googledrive.com/host/0B3fBvzttpiiSSzlxcHFxRC0zYTA/QEMU%20Copy-On-Write%20file%20format.pdf QEMU Copy-On-Write file format], by the [[libqcow|libqcow project]], December 2010
== Tools ==
* [[libqcow]]
[[Category:File Formats]]
[[Category:File Formats]]

Revision as of 05:31, 15 July 2013

QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.

MIME types

File signature

QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")

File types

Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.


The QCOW format is used to store storage media data, e.g. disk images.

The QCOW image file consists of:

  • the file header
  • the L1 table (cluster aligned)
  • the reference count table (cluster aligned)
  • reference count blocks
  • snapshot headers (8-byte aligned on cluster boundary)
  • clusters containing:
    • L2 tables
    • storage media data

The clusters are 512 bytes of size


The QCOW2 format supports optional AES encryption

See Also

External Links