IRFlow Timeline 1.0.9 — Large EVTX Imports Fixed
Published July 27, 2026
IRFlow Timeline 1.0.9 is a focused reliability update for investigations that depend on multi-gigabyte Windows Event Logs.
The 2 GiB failure
Raw EVTX import previously opened the complete source through Node's whole-file readFile() path. Node cannot represent files larger than 2 GiB in one Buffer, so a large Security.evtx failed before IRFlow could parse its first event.
GitHub issue #22 captured the failure on a 4,109,438,976-byte (~3.83 GiB) Security log.
Bounded native EVTX parsing
EVTX is already organized for streaming: a 4 KiB file header followed by independent 64 KiB chunks. IRFlow now follows that structure directly:
- Reads and validates the EVTX file header once
- Reads one native 64 KiB chunk at a time
- Parses and inserts records before advancing to the next chunk
- Reports progress from physical chunk offsets
- Supports the format's maximum 65,535 declared chunks—approximately 4 GiB
Parser memory therefore stays bounded as the source file grows instead of retaining the entire EVTX in JavaScript memory.
Cleaner import recovery
This patch also prevents the same source from being queued repeatedly while it is already pending or running. If a failure does occur, identical notifications collapse into one retryable alert instead of stacking across the interface.
Distinct Excel sheets and AI-history collection scopes remain separate import jobs.
Validation
The regression suite uses the exact 4,109,438,976-byte size reported in issue #22 and verifies that individual source reads remain limited to 64 KiB. The production parser was also validated against a real 2.45 GiB Security.evtx and a complete smaller EVTX import.