Lockpicking Detection

[Satan130]

Is it possible to check out a lock and find out whether or not someone has picked it, either recently or ever ?

The logic in me says no, but the common sense in me is telling me that the logic in me is usually wrong and that you guy's are the experts so...yah.

Thanks

[Squelchtone]

Is it possible to check out a lock and find out whether or not someone has picked it, either recently or ever ?

The logic in me says no, but the common sense in me is telling me that the logic in me is usually wrong and that you guy's are the experts so...yah.

Thanks

There is a book about forensic lock picking detection: http://blackbag.nl/?p=58

I'd like to get a two cylinder Schlage deadbolt, and pick one 100 times, and the other cylinder insert turn and withdraw the working key 100 times, then take some macro photographs of all the pins, as well as the face of the lock and see if there are obvious marks.

If you want to get serious, you could get 4 cylinders, keyed alike, and rake one 100 times, SPP one 100 times, open one with the key 100 times, and then the last cylinder open it 100 times by using SPP, raking, and the key, randomly for 100 attempts. Then take extreme close up color and black and white photos of each set of pins from each lock.

This would make for an interesting project.

Squelchtone

[FrenchKey]

Depending on the method used to open the lock, you may find (with a magnify or a microscope) some different traces.
Look at the pins of locks you have picked, you will see those traces, in comparison with a new lock or a normally used lock.

Bumpkeys leave traces too, pickgun too.

The less detectable might be the impression technique, but it's said that it is detectable anyway, with the proper instruments (like a Scanning electron microscope).
I don't own one, so I can not say

This is the difference between Covert entry and Surreptitious entry.

FrenchKey

[scorche]

LSS also has a great section on forensic analysis of manual picking, bumping, pick guns (both electric and manual "snap guns"), etc. It goes into what too look for, the patterns of the traces, and even gives you nifty little pictures. Also, Marc Tobais's "medeco book" (_Open In Thirty Seconds_) goes into some of the forensic evidence of bumping on pages 176 and 177.

It depends on the tools that were used and the skill/technique of the picker, but picking a lock even once will generally leave traces that can be seen if one looks close enough. For a simple explanation, think about inserting a key into a lock. Imagine the parts of the pins that that key touches/rubs against. Now think of a pick and where that can touch the pin. Due to the shape of picks, they can touch many parts of a pint that a key cannot (sides, higher up on the pin, etc). If these markings are present, it is typically a sign that a pick attempt was made, as it is impossible for a key to have made those markings.

[5thcorps]

I would imagine after a lot of picking the tools will leave some sort of a fingerprint that a keen forensic analyst could identify apart from normal use. But picked just a couple times I don't see how it could be possible.

[mh]

It's possible to detect picking attacks, even if there was only one attack.
IMHO it's difficult to tell whether or not the attack was successful, though.

At least one German police research facility (of LKA Berlin) has done extensive forensic research - with the help of the German locksports organization SSDeV - and some pictures are available in this (German language) article: http://www.lockpicking.org/tmp/Kriminal ... 5_2006.pdf (12MB scan)

The full reports are not available to the public (although quite interesting

Cheers,
mh

[FrenchKey]

It's a shame that it is in German.
We can find another similar forensic analysis in the Oliver's book : Impressioning, available in German and English.
Good pictures and several types of "attacks" are described.

[WDPaladin]

I'll start on translating it now, and should have it up here in a little bit.

[datagram]

I'll be doing a talk on lockpicking forensics at LayerOne 2009 in May, in Los Angeles. It will cover picking, raking, bumping, impressioning, decoding, and bypass. For more info: layerone.info (they should be posting the speaker list soon). The talk was also submitted to Black Hat and Defcon in July 2009, but has yet to be accepted (I'd guess Defcon is a good/definite possibility, but IDK about Black Hat, they are a bit more digitally oriented)

By that time lockpickingforensics.com should be online, as well...and info will of course be added to Lockwiki.com, too.

Squelchtone, I did lots of similar things, but now I am working on photographing and organizing all my info at the moment. PM me if you want more info; I did similar to the OG Paholke tests.

For OP, here is an example image of a pin from a lock that has been picked:



dg

[WDPaladin]

I'll start on translating it now, and should have it up here in a little bit.

Ugh, maybe later tonight, with a google version. I don't have time tonight, sorry!

[Satan130]

wow, i had no idea. thanks guys

[raimundo]

If you find the door open and the cylinder plug is turned, without a key, that is immediate forensic evidence of picking, in some movies, they pretend that scratches on the face plate of the lock is evidence of picking, but that is evidence of amatuerish bad technique.
If a lock is picked, and relocked, plug set. the evidence of this would be whatever is left inside, and no one comeing to that door will be looking for that until he uses his key to open the door. If nothing is immediatly evident to the first person to use the door, it could be weeks before the bloodhounds dissasemble the lock and put the pins under a microscope. It could be years, and a few lock changes before forensic analysis of the pin tips. Or you could just get an expert who reads tea leaves. The romans shook bones and read entrails to read the future, Im not sure if they had any way looking into the past though.

[datagram]

Raimundo,

Well, they could have a staircase key that allows it to be removed when turned. And with tubular locks they could have a key with the top bit removed, which would allow them to remove the key whenever they want (ghetto security measure!)

dg

[FrenchKey]

Theorically, there is a solution to determine whether the picking attack succeeded or not. It's described in the Oli's book, I believe.
When you click back the plug and the pins go back in their plug chambers, they hit very fast the end of the chamber. It may leave a recognizable mark on the pin or in the plug chambers, which can be identified as "non normal" resetting mark, as with a key, they would gently go back to their place. I'm not sure the mark is strong enough to be seen, but with good forensic material, everything can be seen, I guess.

FrenchKey

[mh]

Theorically, there is a solution to determine whether the picking attack succeeded or not. It's described in the Oli's book, I believe.
When you click back the plug and the pins go back in their plug chambers, they hit very fast the end of the chamber. It may leave a recognizable mark on the pin or in the plug chambers, which can be identified as "non normal" resetting mark, as with a key, they would gently go back to their place. I'm not sure the mark is strong enough to be seen, but with good forensic material, everything can be seen, I guess.

FrenchKey

Yes, but the same effect can also be achieved with non-successful picking. The pins would not all hit back at the same time, but that could not be distinguished later.

I heard of a case where a court-appointed expert witness claimed that a lock was not successfully picked, because the edges of the holes in the bible were not broken.
In fact, the 1st part of the forensic study I read shows pictures of such effect, however in a case where the lock was not successfully picked (the forensic experts had not asked the picking experts for help at that time )
So I believe the expert witness was mistaken.

And it still seems to be very difficult to prove that a picked lock was not successfully picked.

"not picked at all" and "picked" can be distinguished,
"successfully picked" might be possible to detect if you find pick tool traces at an angle that can only be reached with a turned plug,
but "picked, but without success" - I'm not sure.

Cheers,
mh