Lockpicking Forensics - RSS 2.0 Feed
Lockpicking Forensics - ATOM 1.0 Feed

 

Lockpicking

Lockpicking is a general term for a wide variety of covert entry techniques, all of which attack the locking components directly. Unlike impressioning or decoding, lockpicking attempts to open the lock without producing a working key or decoding the correct position of components. There are many different lockpicking tools for various lock types.

Pick Guns and Key Bumping are technically forms of pin-tumbler lockpicking, but are given their own pages because of their unique forensic evidence.

Lockpicking Principles

In almost all cases of lockpicking two tools are used. A tension tool is used to gently apply tension to the lock, and a pick is used to position components. As tension is applied to the plug, bolt, or other component, locking components will bind in some way. The pick can be used to determine which component is binding and then used to position it properly. The correct position of a component is known by the attacker through feedback in the form of touch, sound, or sight. The tension tool holds properly positioned components in place, and the attacker repeats the process. Once all components are properly positioned the lock can be unlocked or locked.

The nature of lockpicking necessitates that strong materials be used for tension and picking tools. Tools are commonly made out of steel, iron, and aluminum. Tools are thin (on average 0.025 with pin-tumbler picks) and require a medium amount of force to move locking components. When contacting the softer brass or nickel-silver of locking components, pick and tension tools leave marks in the form of gouges and scratches. The best source of forensic evidence of lockpicking are on the components themselves, but the lock housing, bolt, and cam may also be examined, depending on the type of lock.

Forensic Evidence

The act of using a pick tool is invasive, and we expect the stronger material of the pick tool to cause marks on the softer brass or nickel-silver of the lock components. In this photo, we see scratches where the pick tool was used to lift the pin. These appear to be single-pin picking marks due to their shape and consistency.

A pin-tumbler pin that has tool marks consistent with single-pin picking.

This photo is similar to the last, but instead there are many varied, elongated scratches at different angles and depths on the pin. This type of marking is indicative of a pick that is designed to be gently rubbed against the pins at varying height and tension. Of course, this is the technique known as raking or rake picking.

A pin-tumbler pin that has tool marks consistent with raking.

In this photo, marks left appear to be a combination of both picking techniques. Many attackers will attempt to lightly rake as many pins as possible and then proceed to use single-pin picking against the rest. This may be necessary in the case of security pins that are triggered while raking, also.

A pin-tumbler pin that has tool marks consistent with both single-pin picking and raking.

The marks left by an attacker are in many ways indicative of their skill level. In this photo, extremely deep and plentiful pick marks are shown. The attacker, an amateur, used extreme force on both tension and pick tools. The extreme tension causes pins to bind against plug and require more force to be lifted.

A pin-tumbler pin that has been picked by an amateur. Note the deep gouges and extreme scratching.

This is a very skilled attacker who uses extremely light tension and picking force to reduce forensic evidence. Despite skill, we still find similar forensic evidence. In this photo, pick marks are extremely light but still visible in the center of the pin. We can also see some marks on the side of the pin which are more defined.

A pin-tumbler pin that has been picked using very little tension and picking force.

There are many other designs of pin-tumbler besides the standard round or pointed tips. This is a photo of a Mul-T-Lock telescoping pin tumbler that uses an inner and outer pin stack. Both show signs of picking tools. If we separate the pins, we would also probably find picking marks on the inside chamber of the outer pin.

A Mul-T-Lock Classic telescoping pin tumbler that shows signs of picking tools.

Some pin tumbler designs are rather strange, designed to deter manipulation. This photo shows a Vachette VIP "nippled" pin. The design of this pin is rather complex, with not only a nippled tip but also a very spool like appearance. In any event, picking marks are visible along the nipple and base of the pin.

A Vachette VIP nippled pin tumbler that shows signs of picking tools.

Forensic evidence is also left behind by various lock-specific tools, which are growing more common with high-security locks. In this photo, the pick marks from a Medecoder type tool are visible in the sidebar channel where the tool was used to rotate the bottom pin.

Medecoder type tool marks left on a Medeco Biaxial pin.
Scratches on the sides of pins are also common evidence of lockpicking.

For the attacker, it is difficult to not touch the sides of pins. This can happen during raking as well as single-pin picking. Marks left on the sides of pins are quite noticeable and not as prone to wear and those in the center of the pin. In the photo, light scratches at varied angles are visible.

Long scratches on the side of a pin indicate that an adjacent pin was lifted high.

In the case of low-high pinning combinations it is even harder to lift pins without touching the sides of other pins. In this photo, a series of long scratches travel up the side of the pin. Interestingly, we may be able to measure the length of scratches to determine if the attacker raised the adjacent pin high enough.

Deep, numerous, and well-defined markings left by an amateur attacker on the side of the pins.

Like the bottoms of the pins, the sides can tell a great deal about the skill level of the attacker. In this photo, gouges on the sides of the keys are rather deep, caused by extreme force being used on both the tension and picking tools. With this much material removed, it may be possible to identify pin material on a suspect's possessions.

The movement of the pick through the keyway also leaves forensic evidence in several places. The most common is on the walls of the plug itself. In this photo, scratches left by the pick tool are found below the pin chambers on the walls of the plug. The scratches are at various angles inconsistent with the use of a key.

Scratches in the plug are common evidence of lockpicking in pin-tumblers.

One of the best places to look in the plug is at the top of the keyway. The key will never touch this area, so it is one of the few "virgin" areas in the lock. In this photo, we can see that there are light scratches along the area before the first chamber, probably from the use of a tension tool at the top of the keyway.

Pick and tension tool marks may be found on the top wall of the plug.

Marks on the warding inside of the plug are also common. Normal use of keys does not usually cause these marks, but if they are indeed the cause marks should be present on several other wards, as well. In this photo, a deep gouge has been made by the pick tool on one of the wards deep inside the plug.

A gouge created by a picking tool found along the warding inside of the plug.

Marks may also be left in the pin chambers themselves. In this photo, we see a mark on the left side of the pin chamber. This area of the plug cannot be touched by the key and pins would not make a mark like this unless they were severely deformed. Compare with the chamber wall on the right.

A deformation caused by a pick tool, found on the chamber in a pin-tumbler cylinder.

We might find pick marks higher in the pin chambers, too. These areas are subject to wear as pin stacks are moved by the normal action of the key. In this photo, an up-down-up patterned scratch is seen. This is probably caused by the attacker lifting and lowering the pin stack, trying to find the shear-line.

A tool mark from a lockpicking tool found in the chamber of a pin-tumbler lock.

Forensic evidence of the tension tool can also be identified rather easily, especially if the attacker is a beginner or amateur lockpicker. The act of putting tension on the plug causes the tool to lightly shear the plug walls. In this photo, we can see the gouges left by the tension tool being placed at the bottom of the keyway.

Evidence of a tension tool may be found without having to destroy the plug.

Destructive disassembly of the plug lets us get a better picture of tension tool marks. In this photo, we can see that there is a deep gouge where the tension tool was actually used, as well as several scratches below it. The scratches are likely from positioning of the tool or tapping it with the picking tool while picking.

A series of scratches and a well-defined tension tool mark found inside of the plug.

In the case of a skilled attacker, very light torque is applied to the tension tool. It may be more complicated to identify marks without proper lighting, but even in this example, where low tension was used, the tension tool marks can be identified when they are properly illuminated.

A light tension mark and scratches found inside of the plug.
A cam is shown with a light scratch inconsistent with the use of a key.

The cam may also have marks because many attackers, when navigating the back of the plug, will hit the cam. This is especially true of less controlled techniques like raking. In the photo, a light scratch is present in the center of the cam, a place the key normally does not touch.

Extreme marking on the cam while lockpicking is common with an amateur attacker.

One of the problems as an amateur is knowing where the pick is. It is common to see many amateurs with the tip of the pick poking out of the cylinder. When the cam is on, this may translate into extreme scratching on the back of the cam, as seen in this photo. Similar marks may be left by some forms of bypass.

Effects of wear

The question always arises as to how we can determine when pick marks were made or how long it takes normal wear to remove them. In this photo is the first pin from a lock that has been picked once. We will use this as a reference to see the effects of wear after 250 uses.

A photo of a pin from a lock that has been picked once.

After 250 uses (roughly 2-4 months use) the tip of the pin has been worn by the key, leaving fewer distinct picking marks. At the same time, the sides of the pin still show very clear and distinct picking marks. This is because the key does not touch these areas as frequently and may never, depending on the key bitting.

A pin that was picked once then used 250 times. Picking marks are considerably dulled on the tip of the pin but not the sides.

While taking the last photo I noticed a strange shape in the top right of the photo. When I refocused in that area I found this. It appears to be a small piece of brass that has transferred to the tip of the pin, probably a very small fragment of the key. Quick, call the crime lab!

A fragment of some material is found on the tip of one of the pins being examined.

Non-metal Lockpicks

A small half-diamond style carbon fiber lockpick is shown. Carbon fiber picks are not surreptitious.

Carbon fiber lockpicks were considered for use in Anti-Forensics, but my research shows that they leave marks similar to traditional metal lockpicking tools. The photo shows a finished carbon fiber lockpick in the half-diamond design. This pick is roughly 0.025" thick.

Carbon fiber picking tools leave forensic evidence that is similar to traditional metal tools.

Carbon fiber picks did not work as well as I had hoped. Most importanly they fell short of surreptitious by leaving marks on pin-tumblers similar to traditional tools. In this photo, light scratching along the tip and side of the pin can be seen, caused by a carbon fiber lockpicking tool.

Brass from the pin-tumblers has rubbed off onto the carbon fiber picking tool.

Carbon fiber lockpicks also seem to grab and hold pin materials much better than their metal counterparts. In the photo, a carbon fiber pick is shown with brass residue from the pins of a lock it has picked. This can be used in court as evidence to link a suspect to a crime.

Also considered for Anti-Forensics were fiberglass based lockpicking tools. My research shows that these are also unsuitable because they leave distinct forensic evidence on the pins and inside the plug. In this photo, a half-diamond fiber glass pick is shown. This pick is roughly 0.028" thick.

Fiberglass also left various traces similar to traditional metal lockpicking tools. In this photo, parallel scratches at various angles and positions can be seen on the bottom and side of the pin-tumbler. All marks were cause by the fiberglass picking tool.

Fiberglass picking tools leave forensic evidence that is similar to but distinct from traditional metal tools.

Fiberglass is also less surreptitious than carbon fiber because the act of picking and raking the lock leaves behind a sizeable amount of fiberglass on the pin-tumblers and walls of the plug. In this photo, fiberglass residue can be seen on the tip of the pin-tumbler.

Fiberglass picking tools also leave fiberglass dust on the pins and plug walls inside of the lock.

Like carbon fiber picks, fiberglass does a very good job of trapping trace evidence from the pin-tumbler inside the lock onto the pick. In this photo, the tip of the fiberglass pick is shown with light brass residue and lubricant (black) clearly visible.

The tip of a fiberglass pick showing material transfer (brass) from the pin-tumblers inside the lock.

If you would like to help by donating any lockpicking tools, please contact me.

^Top