Lockpicking Forensics

The most common attack against padlocks is cutting the shackle, either in half or clean off. Almost all low to medium security non-shrouded padlocks are susceptible to this attack. This attack is a form of shearing, and the two edges of the bolt cutter are clearly seen in the displacement of the shackle material.

A closer examination of the tool mark reveals that a red substance is present in the area where the bolt cutter was used. This could be a variety of things; paint, dirt, grease, or rust. We might be able to match this material to the tool if a bolt cutter is found in a suspect's possessions.

Drilling, a form of shearing, is the most common method of destructive entry against all types of locks. It is frequently used by locksmiths to remove locks when they cannot be opened non-destructively. In this photo, the plug of a KIK cylinder has been drilled at the shear line, allowing the plug to freely rotate.

On the Forensic Investigation page we discuss the need to tape any openings in locks recovered at the crimescene. In the photo, a large amount of metal is present inside the lock, a product of drilling. This material is preserved because it may contain evidence useful to the investigation, such as shards of a broken drill bit.

Drills are much like firearms in terms of forensic evidence. Bullets fired from a gun have striae based on the barrel used; the same goes for drill bits used in destructive entry. In the photo, the spiral striae left by the drill bit can clearly be seen in the plug of the lock.

Impact is a versatile method of destructive entry that is extremely effective against windows, doors, and walls. In the photo, a padlock has been hammered until the shackle broke. The direction of the break can tell us what angle it was being struck from. Additional tool marks will likely be found on the body of the padlock.

In this photo, the body of the padlock shows tool marks in places where the hammer impacted the lock. The crescent shaped marks are numerous and can be measured to determine the size and shape of the hammer used. At least three different points of impact are visible.

Heavy damage to the face or keyway of the lock can mean many things. A thorough investigation of tool marks, including angles and positions, helps to reveal how entry was accomplished. In this photo the keyway has been considerably widened and gouged so a tool can be inserted, probably a screwdriver or chisel.

In addition to damage to the keyway, the upper pin chambers have been completely sheared off, leaving the plug and broken cylinder free to rotate in the lock. This attack appears to be torsion applied counter-clockwise to the plug through the use of a screwdriver.

The pins inside this lock show heavy damage from where the screwdriver or chisel was forced into the keyway. Examination of what is left of the tip of the pin shows no indication of covert entry techniques. Because of the force used, tool marks on the pins are rather distinct and may later be used to link suspects to the crime.

European profile cylinders are held in place by a screw that extends through the center of the cylinder. Because the cam is beneath this point, it is the thinnest part of the lock and thus the easiest to break. In this photo, a european profile cylinder has been snapped in half (forced to the left) using common hand tools.

The basis of this attack is that there is enough of the cylinder extending through the door, as little as a few millimeters, and a tool used to grab and apply force to the lock. In this photo, tool marks can be seen where the tool was used to grab the front of the lock.

The cam of the lock can also be examined to determine which way the lock was snapped. This is generally not important, but the lock may have been snapped at an angle that is impossible when the door is closed, indicating fraud or misdirection from the real method of entry.

Many destructive attacks against low security padlocks break the shackle because, relative to the body, it is the weakest component. In this photo, the padlock shackle is broken in two places, with one piece being stuck beneath the locking bolt.

A thorough examination of both the shackle and the padlock body helps to identify the specific technique used. In this photo, the body of the padlock shows excessive distortion in the form of twisting, indicative of extreme torsion being applied to the padlock body.

Tool marks for the torsion tool are found on the edges of the padlock. Marks appear to be rather fresh, thus the most likely candidates for the attack in question.

A closer inspection of the tool mark shows a series of parallel teeth marks, probably from the use of a plumber's wrench or tongue-and-groove pliers. Marks can be used in tool mark comparisons done with tools found in a suspect's posessions.

Simulating lockpicking is common in insurance fraud or when the insurance holder is worried about coverage. These people rarely understand lockpicking and just jam a screwdriver in the lock to make marks. In most cases, material removal and tool marks are present at the front of the cylinder but not past the first or second pin.

The pins in simulated lockpicking will have a large amount of material removal and tool marks that are not consistent with any type of covert entry, including lockpicking or key bumping. Marks will usually not be found on the pins in the back of the lock, too.

Chemicals are powerful because they can fundamentally alter metals to leave them vulnerable to many other attacks. In this case, brass pins are dark red/brown because of NO₂ fumes released when concentrated nitric acid contacted the brass components. Nitric acid has the effect of eating away the copper in brass.

A closer examination can confirm the use of nitric acid by identifying trace evidence left by the chemical reaction between nitric acid and brass. The scattered blue particles are cupric nitrate and zinc nitrate, a byproduct of the chemical reaction.