Lockpicking Forensics - RSS 2.0 Feed
Lockpicking Forensics - ATOM 1.0 Feed

 

Key Analysis

While investigation of locks is important, it is more common that the keying system has been compromised. Much like the cryptography world, systems are not usually broken by some awe-inspiring flaw but instead by the simple act of obtaining the proper keys. The keys to a specific lock can yield just as much information as the lock itself, sometimes more so because of the possibility of hair, fiber, and fingerprint transfer when handling keys. While examination of locks is excellent for determining the method of entry, examination of keys is doubly excellent for the identification of suspects.

If you haven't already, visit the Normal Wear page to see how keys are affected by normal use.

Cuts

"Cuts" refer to the pattern of cuts on the key bitting. The cuts interface with components and, if positioned properly, cause the lock to lock or unlock. The investigator is often asked if a key could have been used to open a lock. Analysis of cut depths, spacing, and keyway can answer this. The key is also evaluated to see if it can be jiggled or partially inserted to allow entry.

Different sets of cuts on the bitting of keys (Schlage, Master Lock, Kwikset). All are factory originals.

Keyway

The keyway profile is the pattern of warding on the key. Many keys have a keyway code stamped to the bow. If not, it can be identified by comparing the keyway with a code book or database. Some advanced key machines can automatically identify a keyway via optics or lasers. Keyway identification allows the investigator to determine if the key fits the lock, thus is able to position components correctly.

Five different keyway profiles shown. Left to right: KABA, Winkhaus, Schlage, Kwikset, Master Lock.

Codes

Many keys have codes that identify cuts and keyway. Bitting codes may be direct (literal) or indirect (obfuscated). In the case of indirect codes, the manufacturer may be able to determine to whom and where the key belongs. Other information may also be stamped on the key, such as the name of lock brand, key brand, or the locksmith/hardware store that produced the key. All of which may be used to identify a suspect.

The bow of a Master Lock key, with keyway code (400B) and indirect bitting code (4XX9976) shown.

Key Material

The material of a key can identify factory original keys, and in some cases specific third-party manufacturers. Certain manufacturers use proprietary alloys to increase longevity and strength of their keys, some of which can be traced back to them. The photo shows three different keys, each made of a different material.

Three different key materials are shown. Can you guess them all?

The plating on a key also provides some clues. Manufacturers usually plate factory-original keys after they are cut, while locksmiths and hardware stores will remove the plating of a blank key when making cuts. The plating material may also be used to identify the key blank manufacturer.

A nickel-silver plated brass key is shown. The bow is a good place to look to find wear that exposes the real key material.

Key Duplication

A factory original key. Notice the flat valleys and properly angled slopes.

Keys can be duplicated in many ways, but the most common is duplication by hand or with a key machine. Identifying an original vs. duplicate key is an important function of the forensic locksmith. In addition, the forensic locksmith may be able to determine if the key was recently duplicated.

A duplicate of the above key. Notice the different in the valleys and slope angles.

In this photo, the duplicate key is shown. Notice that the ramps and valleys of the key are slightly different than the previous photo. In addition, we see that the key is nickel-silver plated, with no plating on the cuts. Depending on the factory-original specifics, this may also indicate that it is a duplicate key.

A key that is copied with a stylus will have distinct forensic evidence on the original key.

When a key is duplicated with a stylus-based key machine a mark is left on the side of the original key. This is due to the stylus being gently dragged against the key, and resembles a long, straight, polished line. This cannot be confused with wear of the key because it is not in the direct center of the key.

A comparison of two keys cut with different speed key machines. Notice the difference in the grain of the cuts.

Keys can be examined to determine the speed and blade design of the key machine was used to cut them. This photo shows a comparison of two keys, with the one of the left being cut with a lower speed key cutter. If a key machine is found with a suspect, it can be examined to determine if it was used to cut a specific key.

Handmade Keys

Possession of keys that are made by hand are, in a general sense, somewhat suspicious. In most cases hand made keys are easily identified by measuring the ramp angles, shoulder to first cut distance, and the distance between cuts. Hand-made keys generally have imperfect, jagged ramp angles and poorly spaced cuts.

A hand-made key that is easily identifid because of varying slope angles, uneven valleys, and dissimilar cut spacings.

In this photo we see many groups of scratches, with slightly different angles, across the bitting of the key. This is consistent with the use of a file. Specifically, this is a flat file being used on the broad side. With a tool mark comparison we can determine the size, shape, and grade of the file(s) used.

The bitting of a key that has been filed with a flat, wide file of medium grade.

In this photo we see a series of cuts with variable depth valleys and light material removal around the edges. This is consistent with use of a dremel. Again, tool mark comparison can determine exactly which dremel bit(s) may have been used. These can be linked with tools found in a suspect's possessions.

A key that has been cut with a dremel. Note the differences between this and a filed key.

Toolmark Identification

A strange mark is left on the bow of a key, potentially pointing to malicious activity.

Sometimes marks will be left on the key as a result of normal or malicious use. When a key is duplicated with a cutter, the clamp to hold the original or the blank may leave a mark. In addition, some covert entry techniques may leave tool marks. In this photo we see a set of rather deep marks on the bow of the key.

A close up of the previous photo's largest mark. This mark was identified as a pair of vice grips, commonly used during impressioning via manipulation.

Close up we see a distinct pattern on the largest tool mark. We can hypothesize what made this, and perform a tool mark comparison to confirm. This particular mark was made by a pair of vice grips being used to impression (via manipulation) a blank key. The key should also be examined for impressioning marks.

An impressioning mark is found by viewing the key under an ultraviolet light source.

Keys that have been used in manipulation based impressioning may show impressioning marks along the key bitting. Close examination of the key for such marks may help to determine its intended purpose. In the photo, an impressioning mark is found by viewing the key under ultraviolet light.

The shoulder of a bump key; compression and distortion are due to repeated use.

In many covert entry techniques a key is used as a tool to affect entry. Keys with unusual marks or deformations can provide clues as to their use or intended purpose. In this photo, the shoulder of the key is deformed and compressed. This happens to be a bump key's shoulder, caused by impact against the face of the lock.

Material Transfer

Various materials are transferred to the key during use. Generally hair, fiber, and fingerprints will be examined by a crime lab. The forensic locksmith, however, may examine the findings of the crime lab to identify the uses of materials found on keys. Here we see a light green residue, which happens to be modeling clay.

A slope on a key that has been used for impressioning via copying (clay).

In this photo we find small traces of white wax left in the warding of the key. Both this and the previous image indicate that the key has been impressioned (via copying). Through further analysis we may be able to link these and other materials to those found in a suspect's possessions.

The warding of a key that has been used for impressioning via copying (wax).

Keys should also be viewed under various light sources to attempt and fight any material residue that may not be visible with the naked eye (or naked microscope?). In this photo, a key is being viewed under ultraviolet light to discover traces of ultraviolet ink along the key bitting area, indicative of impressioning via manipulation.

A key that has ultraviolet ink residue along the key bitting. Indicative of impressioning via manipulation.

^Top