Native tool observations / synthetic inputs

QCOW2 external-data observations

Sixty offline observations separate external payload identity, working-directory resolution, zero-write semantics and successful metadata inspection.

Metadata / Full command receipts / Python harness / Analysis and interpretation

Method

Ten isolated cases x two data_file_raw modes x three repetitions on one host. A four-cluster, 256 KiB disk is written with known bytes and one cluster is zeroed. Every successful raw export is compared at every byte position with an independent oracle. The independent expected clusters contain 0x11, 0x00, 0x33 and 0x44. No guest filesystem or backing file is present. Every process closes before the next manipulation. The original 30 backing-chain observations remain a separate, unchanged study.

What each control establishes

The byte-flip, replacement and truncation controls change 1, 196,608 and 131,072 guest bytes respectively while check returns 0. Missing data causes check 1, compare 2 and export 1, but info still returns 0. A successful metadata report is not evidence that the payload opens.

The pair-moved control moves both files but keeps the old working directory. Pair-moved-cwd changes that directory too; pair-moved-explicit supplies the relocated data child. Only the latter two recover the expected bytes in this package. Runtime-override selects replacement bytes without changing either original file. Command receipts retain the relative working directory and opening options.

Before mutation, directly reading the raw-off external file differs from the virtual disk by 65,536 old bytes in the zeroed cluster. Raw-on matches. This distinct baseline measurement is retained in every row as initialDirectRawChangedBytes. Out-of-band editing afterward can invalidate the initial pairing; raw mode is not authentication or secure erasure.

Reproduce

Measured: qemu-img version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.18); Python 3.12.3; Linux 6.8.0-146-generic. Package executable hashes and the harness hash are retained. Upstream review is pinned to v8.2.2, not claimed identical to Ubuntu's patched binary.

python3 -B observe.py --output fresh-results.json
python3 -B build.py --input fresh-results.json --output-dir replay
python3 -B -m unittest -v test_observe

Download the harness, validator and generator, tests and canonical results.json into one directory. Python uses only its standard library; qemu-img and qemu-io are also required. QEMU_IMG and QEMU_IO select test executables; the harness has equivalent command-line flags. It accepts no existing image, bounds subprocess time and refuses to overwrite its output.

The validator rejects missing or duplicate cases, changed harness identity, wrong payload hashes, false success labels and command/summary disagreement. It checks these version-scoped expected outcomes; a different version may need review. CSV has empty cells for null and True/False for booleans; JSON preserves their types. These records are reproducible observations, not authenticated third-party logs.

Limits

• Synthetic offline files, not a VM restore, crash experiment, field failure sample or benchmark.
• One Ubuntu QEMU 8.2.2 package and regular-file backend; no assurance about other versions or runtimes.
• No backing file, guest filesystem, compression, encryption, internal snapshot, dirty bitmap or live writer.
• Raw-mode agreement is checked before manipulation; out-of-band payload edits can break that agreement.
• File hashes identify bytes, not authenticity, intended recovery state or application consistency.

Column definitions

case

Controlled manipulation; every case begins from a fresh private fixture.

rawMode

data_file_raw creation flag, not a guarantee after out-of-band modification.

repetition

Repeat on one host, not an independent reliability sample.

checkExit

qemu-img check exit: 0 consistent; 1 opening failed in these fixtures.

infoExit

qemu-img info --backing-chain exit; zero does not prove payload readability.

compareExit

qemu-img compare exit: 0 equal; 1 completed difference; 2 opening failed.

exportExit

Raw export exit: 0 completed; 1 opening failed in these fixtures.

metadataUnchanged

Metadata file size and SHA-256 unchanged from its pre-manipulation snapshot.

changedGuestBytes

Differing positions across all 262144 guest bytes; null when unreadable.

initialDirectRawChangedBytes

Difference count when reading the intact external file directly, before manipulation.

Sources and reuse

Original code, synthetic observations and synthesis: CC0-1.0. Upstream sources retain their own licenses. The source manifest records retrieved source hashes; the source review distinguishes source statements from measured behavior.

1. QEMU v8.2.2: external-data feature bits and standard cluster descriptors
2. QEMU v8.2.2 iotest 244: external data, zero writes and raw-mode controls
3. QEMU v8.2.2: external data-file opening and creation implementation
4. QEMU v8.2.2: external-data treatment in reference-count checks
5. QEMU v8.2.2: image information collection and NO_IO opening

Related definitions: QCOW2, external data file and backing chain.