Qcow2
Definition
QEMU Copy-On-Write version 2. The native disk format for QEMU and KVM hypervisors, with built-in snapshot, compression and encryption support. Used widely on Indian Linux servers, OpenStack clouds and CERT-In sandbox infrastructure.
- Full name
- QEMU Copy-On-Write version 2
- Native to
- QEMU and KVM hypervisors
- Built-in features
- Snapshots, compression, encryption
- Forensic relevance
- Common VM disk image format to acquire and mount
Common questions
Why do qcow2 snapshots matter to a forensic examiner?+
A qcow2 file can contain multiple internal snapshots representing the disk state at different points in time, so an examiner who only images the current file may miss earlier states preserved in snapshot layers that require dedicated tools to enumerate and extract.
Can a qcow2 image be analysed without a running hypervisor?+
Yes. Tools such as qemu-img can convert a qcow2 file to a raw format, and libguestfs-based utilities can mount it directly, letting an examiner work with standard disk forensic tools without needing to boot the virtual machine.
Does encryption on a qcow2 image block forensic access?+
If the image uses qcow2's built-in LUKS-based encryption, the examiner needs the passphrase or key to decrypt it; without that credential, the encrypted image contents remain inaccessible regardless of standard imaging technique.
Related terms
- Files on-Demand
- Microsoft OneDrive feature that represents cloud-only files as 0-byte placeholders on the local NTFS volume, marked with a reparse tag IO_REPARSE_TAG_CLOUD. The...
- Reparse Point
- An NTFS attribute that redirects file access to another handler. Cloud providers use reparse tags to insert their sync drivers between the...
- Snapshot Chain
- A parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading...
- VHDX
- Microsoft's second-generation virtual hard disk format, used by Hyper-V and recent Windows containers. Supports up to 64 TB, has block-level CRC, and...
- VMDK
- VMware Virtual Machine Disk. The on-host file that holds the guest VM's disk contents, either as a monolithic file or split into...