Everything here was read in three real bundles on a Mac (an Ubuntu 24.04.3 ARM64 and a Fedora 42 ARM64 machine, and a macOS guest), read only; nothing was started. Parallels does not publish these files, so each row says whether its meaning is documented (a public source), observed (seen, and checked against another file where possible) or undocumented.
The members
| Name | Size seen | What it is | Basis |
|---|---|---|---|
config.pvs | 28,662 to 30,812 bytes | The configuration: XML. | observed |
config.pvs.backup | same as config.pvs | A copy of the configuration (the same size in all three bundles). | observed |
NAME-0.hdd/ | folder | A disk: a .hdd bundle with DiskDescriptor.xml, its backup and the .hds image. | documented in part (QEMU) |
VmInfo.pvi | 946 to 10,138 bytes | What the guest tools reported: below. | observed |
NVRAM.dat | 385,024 bytes | The guest firmware’s variable store: below. | observed |
parallels.log | 232 KB to 1 MB | The machine process’s text log: below. | observed |
statistic.log | 0 bytes | Empty in all three bundles; named like a statistics log. | observed |
.version | 2 bytes | The text 1 and a line feed. | observed; meaning undocumented |
config.sav, suspended.png | 3.6 GB; 3.5 MB | Present only in the macOS bundle, which had been suspended: below. | observed |
machw.bin, macid.bin, aux.bin | 132; 68; 33,579,164 bytes | Only in the macOS bundle: the data of Apple’s Virtualization framework. See the macOS bundle page. | see that page |
VmInfo.pvi
XML with the root <VmInfo dyn_lists="" schemaVersion="1.0">, written from what the Parallels Tools in the guest reported.
| Element | Seen | Meaning |
|---|---|---|
GuestOsInformation/Started | 0 (Fedora), 1 (macOS) | Whether the guest had started when the file was written (by its name and values). |
RealOsType | “GNU Linux, 64bit, 2 cpu(s), page: 4096b”; “Apple Mac OS X, 64bit, 4 cpu(s), page: 16384b” | What the tools reported: the system, its width, the CPU count and the memory page size. Checked: the CPU counts match Hardware/Cpu/Number in config.pvs. |
RealOsVersion | “Fedora release 42 (Adams)”; “26.4.1, build 25E253, platform VirtualMac2,1” | The guest’s version string. |
RealOsTypeId | 9 (Fedora), 7 (macOS) | A number from Parallels’ guest list. Checked: equal to OsType in config.pvs. |
ConfOsType, ConfOsVersion, OsKernelVersion, RealOsDetails, DisplayVersion | empty | Undocumented. |
DeviceId, DeviceName, SerialNumber | a GUID, the guest’s host name, a serial number | The guest’s identity, by their names. |
GuestToolsList/GuestToolInfo (about 15 in the Linux file) | ToolId (like parallels.ToolsInstallStage.guest.cross), ToolName, ToolVersion, ToolInternalVersion, ToolDate (an ISO date with Z), ToolState, ToolData (hex), ToolStringData, ToolUpdateStatus (“UpToDate”) | One entry for each Parallels Tools component in the guest, by the names. Undocumented. |
AdvancedEngineInfo | EngineTypeStr, EngineTypeNum | Undocumented. |
NVRAM.dat
385,024 bytes in both Linux bundles. The first 0x10000 bytes are zero here. At 0x10000 a UEFI firmware volume begins: the signature _FVH is at
0x10028, the 8 bytes at 0x10020 hold 0x4E000, and 0x10000 + 0x4E000 is exactly the file size, so the firmware volume runs to the end of the file.
The layout of that header is the UEFI Platform Initialization one, which was not read in this session; and what the variables inside hold
is not described by any source read. This is the store the guest’s UEFI firmware keeps its variables (boot entries and settings) in, by its shape and by the
bundle it sits in.
parallels.log
Text, one event a line, each starting with the date and time as MM-DD HH:MM:SS.mmm, then a letter and a source such as
/vm:8414:84b9e/, then the message. The first line is ***** VM process started and the second lists the machine process’s arguments:
the path of prl_vm_app inside Parallels Desktop and its --vm-name, --uuid, --dir-uuid and --log-dir.
The meaning of the letter and the numbers is not documented.
Saved state and snapshots
- In the bundles read: only the macOS bundle was suspended. It has
config.sav(3,623,882,752 bytes), which starts with the eight bytes65 76 61 53 4D 56 5A 56, the textevaSMVZVor, read as one little-endian number,VZVMSave, andsuspended.png, a PNG of the screen. That header names Apple’s Virtualization framework (its sample saves a machine’s state to a file calledSaveFile.vzvmsave); the rest of the format is not documented. - Reported, not seen: Parallels users’ forum posts describe a
Snapshotsfolder with aSnapshots.xmland files ending.mem(memory at the time of a snapshot),.sav(state at suspend),.pvc,.pvi,.pngand.dat, with the disk snapshots kept as further.hdsimages inside the.hddbundle. None of these is in the three bundles, and no document read gives their formats. The disk side is documented by QEMU: see the snapshot tree in DiskDescriptor.xml.
Sources: three real bundles on the owner’s Mac (read only); prl-xml.rst from QEMU for the disk side; Parallels Desktop user guides and the forum
threads found by search for the reported snapshot files (anecdotal; marked as reported).