# QCOW2 external data: source and inference ledger

Checked 2026-10-21. Question: does an inventory of backing files and a passing
image check establish completeness of an external-data QCOW2 recovery copy?

## Scope and relation to the corpus
Extend qcow2-backing-chain-verification, not a duplicate COM article.
The original 30 observations are unchanged. This supplement has 60 fresh
fixtures: 10 cases x 2 data_file_raw creation modes x 3 repetitions.
It connects backing-chain preservation, expected-content integrity, sparse zero
semantics and the existing HDF5 external-dependency discussion.

## Primary evidence
- QEMU v8.2.2 docs/interop/qcow2.txt: incompatible bit 2 identifies external
  payload storage; the raw external-data autoclear bit is bit 1. Standard
  descriptors can supply logical zeros. The spec's raw-bit paragraph refers
  parenthetically to incompatible bit 1, inconsistent with its own external
  data definition at bit 2. We use the named features, not that cross-reference.
- QEMU v8.2.2 tests/qemu-iotests/244, efficient/valid-raw sections: upstream's
  own zero-write controls distinguish stale bytes in a raw-off external file
  from the raw-on zero-write behavior. We wrote our own bounded harness and
  did not redistribute or execute this GPL test.
- QEMU v8.2.2 block/qcow2.c, qcow2_do_open: configured data child first,
  stored image_data_file fallback. The header name alone is not a complete
  runtime-resolution description.
- QEMU v8.2.2 block/qcow2-refcount.c, check_refcounts_l2: external payload
  clusters are treated differently from metadata refcounts. This is structural
  checking, not a trusted expected-byte comparison.
- QEMU v8.2.2 qemu-img.c, collect_image_info_list: NO_IO / NO_BACKING flags
  and manual backing traversal. The actual missing-data info outcome is native
  evidence from the Ubuntu-patched binary, not asserted from upstream alone.
- Source URL, HTTP status, length, retrieval timestamp and SHA-256 are in
  sources.json; no third-party source text is republished.

## Native observations, not hypotheses
Package: qemu-img/qemu-io 8.2.2, Debian 1:8.2.2+ds-0ubuntu1.18. Binaries are
reused from the previously authenticated Ubuntu extraction; hashes are recorded.
The measured distribution is not claimed byte-identical to the upstream tag.
Private regular files only; no VM, host block device or production image.

We write 0x11,0x22,0x33,0x44 to four 65536-byte clusters, then zero cluster 1
through QEMU. The independent guest oracle is 0x11,0x00,0x33,0x44.
Before mutation, direct external-file reads differ in 65536 bytes with raw off,
and match with raw on. All successful exports have exactly 262144 bytes.
All final checks preserve the original metadata-file SHA-256 and length.

Changing the first payload byte changes one guest byte. Replacing the external
file with 0x55 changes 196608 bytes. Truncating to 131072 bytes produces a zero
tail and changes 131072 guest bytes. All three complete check successfully.
Missing data is different: check exits 1, compare exits 2, export exits 1.
Info exits 0 for all fixtures and still reports the stored payload.bin name.

Moving the pair into restore/ while executing from the original directory fails.
Executing inside restore/, or supplying the relocated data child explicitly,
recovers every expected byte. Relative-name behavior is version scoped.
An explicit replacement child changes 196608 bytes while BOTH original
metadata and original payload hashes stay intact. Info still reports the
header's payload.bin declaration. Effective open configuration matters.

## Synthesis and boundaries
Inventory and identity of the interpreted disk require more than a list of
backing members. Capture external data dependencies AND effective resolution.
Raw-off payload alone can contain bytes that are not logically present.
Raw-on is not authenticity or protection against out-of-band editing.
The zero-write observation is not a media-erasure experiment.
No crash consistency, application recovery, rate estimate, performance benefit,
new vulnerability, or cross-version guarantee is claimed.
Next useful investigation: repeat under a current independently provisioned
QEMU package and a real VM manager's explicit block graph, then assess bitmap
preservation as a distinct recovery asset.