January 2019 - Stark 4N6

Tuesday, January 22, 2019

Tech Tuesday: Aukey LC-C6 Wireless Charger
January 22, 20190 Comments

Another Tech Tuesday and another Aukey product. This time we will be looking at their LC-C6 wireless fast charger.

It comes in Aukey's standard beige flip top package. The contents include the charging pad, a micro USB to USB-A cable, the user manual, and their #TECHKEY sticker as well.

This lightweight charger can fast charge devices up to 10W and is even supposed to work through most phone cases as well. In testing, it fast charged my Galaxy Note 8, through it's OtterBox case, from 0 to 25% battery in about 30 minutes. 

One thing I wish that Aukey would have included is the adapter end that plugs into the wall, so you won't get fast charging if you don't have an adapter that supports it. Overall, I can see this going on my desk either at home or work to get some extra juice while I'm sitting around. You could even pack this easily in your bag for on the go as it's slim design and light weight won't burden you.

Monday, January 21, 2019

Chopping Down Artifacts from AxCrypt
January 21, 20190 Comments
AxCrypt is a tool that I recently came across that can encrypt your files on the go and quickly. As a company, they have been around since 2002 but their 2.0 product was released just in 2016. It has won multiple awards as their site shows.

There are two versions that you can download, an EXE installer version and a portable version. Before being able to use AxCrypt, you have to set up an account with an email address and a master password that will be used to encrypt/decrypt everything.

The interface is pretty simple, you add files to the tool and it automatically encrypts the file using AES-128 or AES-256 (depending on your license).

User/Install Information

In the AppData folder for the user that it was installed/run on, 4 text documents are present:


FileSytemState - Includes "watchedFolders", folders setup to auto encrypt, "activeFiles" which appears to be recent files, including "decryptedFolder" paths, decrypted file names, encrypted file paths, as well as last activity times and last encryption write times

UserAccounts - Displays information regarding the email address associated with the product, the account "level" type or license type, expiration date for the account, and public and private key information

UserPublicKeys - Shows the email address as well as the public key associated with it (I'm assuming if you import more keys they would show here as their is a flag for "user_imported")

UserSettings - Details settings for the actual application (version #, update URL, window height/width, last update check date/time)

Renames and LNKs

Looking at the USN journal you see that once a file gets loaded into the tool for encryption, it gets renamed adding a dash (-) and the extension to the file name then gets a .tmp extension before its final extension .axx.

There is also an option in the tool that will rename the file itself to what they call "Anonymous Rename" which will change the current file name to a 10 digit numeric name, keeping the .axx extension, a more practical option if you are trying to conceal any possible context of the contents.

When decrypting a file they are loaded into a temporary folder at:


The naming convention for the folder appears to be 8 character lowercase alphanumeric. It gets noted in the FileSystemState.txt file from above. This could be helpful to know if you come across a system that has AxCrypt running and has files open where you can locate the decrypted original files.

Preliminary testing:

  1.  A new file "NewTest.txt" was created with some content
  2. File dragged into AxCrypt portable, file name gets changed to "NewTest-txt.axx" and encrypted
  3. "NewTest-txt.axx" is opened and view, created a LNK file
  4. Anonymous Rename option selected and file added, "NewTest-txt.axx" gets renamed to "2028781783.axx" on the desktop.
  5. When opening "2028781783.axx", a LNK is created with the same name

When looking at both LNK's, the file sizes are the same as well as the Object-ID's, possibly deducing that these are/were the same file.

Another item to look for is execution after opening an .axx file. Since they are regular files such as a TXT or a PNG, it will natively open the file in something that can read it. For instance, after opening "2028781783.axx" it runs Notepad, helping narrow down what file type it originally is.

AxCrypt does a pretty good job in concealing originally names, if you choose the Anonymous Rename option and naturally it encrypts well with AES. I hope to look at what else I can dig up in a future post.

Tuesday, January 15, 2019

Tech Tuesday: Aukey PB-Y13 Portable Charger
January 15, 20190 Comments

Part of being a tech geek is always looking for new things to add to the grab bag whether it's for work or for traveling on the go. So in an effort to post more often other than forensic research I will be doing Tech Tuesday every so often to look at new items.

So for the first week I will be looking at the Aukey PB-Y13 portable charger. I've been a fan of Aukey products for a few years now after buying some of their multi-port chargers from Amazon. This slim charger is 10,000 mAH and features 3 ports on the front, one USB-C and two USB-A ports (one with Quick Charge 3.0 and one with your standard DC 5V 2.4A).

They're simple packaging design can been seen across most of their products (more to come). Inside the box is the charger, a USB-C to USB-A cable, the manual and their #TECHKEY sticker. The charger is just about the same size and thickness as my Pixel 2 (see below).

I was able to test the USB-C output and it charged my phone from 20% to 50% in about 15 minutes. You can charge the charger using USB-C in or with a micro USB cable (not included). 

The only downside is that the charging cable that came with it looks like it melted on the side so the inside was exposed a bit but overall a great product to slide into the backup for some extra juice in a time of need especially for the price.

As an added bonus, WireCutter has listed this one as it's favorite powerbank for fast charging.