ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "QCOW Image Format"

From ForensicsWiki
Jump to: navigation, search
(External Links)
 
(8 intermediate revisions by 2 users not shown)
Line 7: Line 7:
  
 
== File types ==
 
== File types ==
Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.
+
Currently there are three versions of the QCOW1 format; namely QCOW (version 1) and QCOW2 (version 2).
 +
Version 3 is considered an extended variant of QCOW2.
  
 
== Contents ==
 
== Contents ==
Line 34: Line 35:
 
* [http://people.gnome.org/~markmc/qcow-image-format-version-1.html The QCOW Image Format], by [[Mark McLoughlin]], June 2006
 
* [http://people.gnome.org/~markmc/qcow-image-format-version-1.html The QCOW Image Format], by [[Mark McLoughlin]], June 2006
 
* [http://people.gnome.org/~markmc/qcow-image-format.html The QCOW2 Image Format], by [[Mark McLoughlin]], September 2008
 
* [http://people.gnome.org/~markmc/qcow-image-format.html The QCOW2 Image Format], by [[Mark McLoughlin]], September 2008
 +
* [https://github.com/libyal/libqcow/blob/master/documentation/QEMU%20Copy-On-Write%20file%20format.asciidoc QEMU Copy-On-Write file format], by the [[libqcow|libqcow project]], December 2010
  
 +
== Tools ==
 +
* [[libqcow]]
 +
* [http://www.bitrecover.com/virtual-drive-recovery-software/ QCOW Data Recovery] - Recover data from corrupt or crashed QCOW, QCOW2 virtual image files.
 
[[Category:File Formats]]
 
[[Category:File Formats]]

Latest revision as of 08:29, 25 February 2016

QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.

MIME types

File signature

QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")

File types

Currently there are three versions of the QCOW1 format; namely QCOW (version 1) and QCOW2 (version 2). Version 3 is considered an extended variant of QCOW2.

Contents

The QCOW format is used to store storage media data, e.g. disk images.

The QCOW image file consists of:

  • the file header
  • the L1 table (cluster aligned)
  • the reference count table (cluster aligned)
  • reference count blocks
  • snapshot headers (8-byte aligned on cluster boundary)
  • clusters containing:
    • L2 tables
    • storage media data

The clusters are 512 bytes of size

Encryption

The QCOW2 format supports optional AES encryption

See Also

External Links

Tools