QEMU Copy-On-Write Disk (QCOW)
| Format | QEMU Copy-On-Write Disk (QCOW) |
|---|---|
| Short name | QCOW |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
QEMU Copy-On-Write disk (QCOW version 1, QCOW2 versions 2 and 3). Begins 'QFI' 0xFB and the version, followed by a header, a two-level cluster table (L1/L2) and refcount tables. Clusters are allocated as written and can be compressed; an image can hold internal snapshots, keep its data in an external file, or be an overlay of a backing file, so the disk's content spans both files. Can be encrypted with LUKS or QEMU's older AES. Used by KVM/libvirt, Proxmox, OpenStack and GNS3, and by the Android Emulator, which keeps a virtual device's user data as a QCOW2 overlay (userdata-qemu.img.qcow2).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 51 46 49 FB | QFI. | QCOW magic 'QFI' 0xFB, followed by the version (1, 2 or 3) |
Known extensions
.qcow, .qcow2
References
- The QCOW2 Image Format (QEMU docs/interop/qcow2.rst) https://www.qemu.org/docs/master/interop/qcow2.html
- QEMU Copy-On-Write file format — format documentation (libyal/libqcow) https://github.com/libyal/libqcow/blob/main/documentation/QEMU%20Copy-On-Write%20file%20format.asciidoc
- ForensicsWiki — QCOW image format https://forensics.wiki/qcow_image_format/
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “QEMU Copy-On-Write Disk (QCOW)”. https://kalink0.github.io/crush-forensics/formats/qcow/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction