File Size and Processing Limits

Two limits, and they interact in a way worth understanding before you conclude a file was analyzed when it was not.

The size limit

512 MiB per file, which is 536,870,912 bytes rather than 512,000,000. Anything larger is rejected at upload rather than truncated, so an oversized file is absent rather than partially present.

For archives, the limit applies twice: once to the archive itself, and once to each file extracted from it. A 400 MB archive is accepted, and a 600 MB file inside it is not, so an archive can be processed successfully while one of its contents is skipped.

The time limit

Analysis must finish within 15 minutes. If it does not, processing stops there.

Files approaching 512 MiB are the ones at risk, and how close you get to the limit depends on more than size: file type complexity, archive depth and structure, and current load all matter. A deeply nested archive of many small files can be slower to work through than a single large binary.

Why this matters for what you can find later

This is the practical consequence, and it is the same shape as the collection policy in What Gets Collected.

A file that exceeded a limit was not analyzed, so it has no verdict, no variants, and will not match a YARA rule written afterwards. Rules reach backwards through everything Stairwell holds and processed, and cannot reach something that was never processed.

That is worth knowing when a search comes back clean on a fleet with large installers or disk images. Clean means nothing matched among the files that were analyzed, which is not the same claim as nothing matched.

What should I read next?

• What Gets Collected, for the other boundary on what Stairwell holds.
• Objects, for what happens to files unpacked out of archives.
• Who to Contact for Support, if a file you need analyzed is over the limit.