Digital forensics and incident response
Endpoint timeline exports, firewall logs and carrier records arrive as CSVs far past what a spreadsheet will open, with timestamps in different formats and identifiers already mangled. BigXL opens them at any size, normalises the formats, and correlates several sources on your own workstation. It makes no network requests for file processing, so evidence never leaves your custody.
Triage starts with a file you cannot open
An EDR timeline export runs to ten million events. Firewall logs cover the same window in a different timestamp format and a different time zone. The one tool everyone has gives up at a million rows, and the quick online converter is the one thing you are not allowed to use.
BigXL is for that first hour: get into the file, make the formats agree, and narrow it down.
Open it
CSV, TSV, compressed .gz and .zst, Parquet, and Excel workbooks, at any
size, with no row limit. The grid streams from disk, so you are scrolling while
indexing is still running. Sorting, filtering, summary statistics and pivots
cost nothing.
Make the formats agree
Correlation fails on formatting long before it fails on logic. The Pro cleaning tools standardise mixed date and time formats to one pattern and refuse genuinely ambiguous values rather than guessing. Long identifiers such as IMEIs and account numbers stay as text, so they do not arrive as 8.43E+12 or lose their last digits. Sub-second precision is preserved exactly as written in the source.
Correlate several sources
Join exports on a shared key, such as a host, a user or a number, in a single pass, at sizes where a spreadsheet cannot open either file. Merging happens by header name rather than column position, so a source that names its columns differently does not silently shift values into the wrong place.
For anyone who does want to drop down a level, the Pro tier includes a SQL console, but nothing above requires it.
Working on your own hardware
BigXL processes files locally, so no file data is transmitted, including when you use Bix, the plain English assistant, which runs on your own CPU. It behaves the same on an air-gapped machine.
Source files are opened read-only and never written to, so their hashes are unchanged. The Enterprise tier can mask personal data before a subset is shared outside the response team, and can write a privacy scan listing which columns hold personal data without including any values from the file.
What BigXL does not claim
BigXL can generate a certificate recording the transformations applied, with SHA-256 hashes of the source and exported files, and can export the session’s change log. These are BigXL’s own records of what it did. They are not an official certification, they confer no admissibility, and they make no compliance determination. Whether any export is admissible, and whether custody was maintained, are decisions for your process, your counsel and the court.
Common questions
How do I open a timeline export with more than a million rows?
Excel stops at 1,048,576 rows. BigXL has no row limit and streams from disk rather than loading the file into memory, so a 20 GB export opens without splitting it first. Opening, sorting and filtering are free.
Does BigXL modify the source file?
No. It reads source files in streaming mode and applies sorts, filters and cleanups to an internal working copy. The original on disk is never written to, so its hash is unchanged. Chain of custody is a process your team runs, not something a tool maintains for you.
Can I correlate several exports without uploading them?
Yes. Joins across files, timestamp normalisation and keyword searching all run locally. BigXL works on an air-gapped workstation. Only a manual update check contacts BigXL, using the signed licence key rather than file data.
Will it corrupt sub-second timestamps or long identifiers?
No. Fractional seconds are preserved as written rather than rounded, and long numeric identifiers such as IMEIs stay as text instead of collapsing into scientific notation or losing their final digits.