Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn
QCOW Image Format
QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.
QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")
Currently there are three versions of the QCOW1 format; namely QCOW (version 1) and QCOW2 (version 2). Version 3 is considered an extended variant of QCOW2.
The QCOW format is used to store storage media data, e.g. disk images.
The QCOW image file consists of:
- the file header
- the L1 table (cluster aligned)
- the reference count table (cluster aligned)
- reference count blocks
- snapshot headers (8-byte aligned on cluster boundary)
- clusters containing:
- L2 tables
- storage media data
The clusters are 512 bytes of size
The QCOW2 format supports optional AES encryption
- The QCOW Image Format, by Mark McLoughlin, June 2006
- The QCOW2 Image Format, by Mark McLoughlin, September 2008
- QEMU Copy-On-Write file format, by the libqcow project, December 2010