Picked the key lock

I managed to pick the key lock of the safe using these lock picks. Now it only takes me up to 20 seconds to pick that lock. It seems to be a standard cylinder lock with now extra security. The cylinder rotates a few degrees and then stops. When I now turn the combination dial I can feel the key cylinder changing its rotation angle and the dial rotation is hindered by some friction.

A first analysis of the dial indicates a deep depression between 55 and 59. At the moment I assume this to be the cam gate location. Once the notch drops into this I have to turn the key cylinder slightly back to get out of it.This indicates that the cam gate has steep sides and maybe even the lever nose. If that is true I wont be able to measure the lever nose depth by measuring the cam gate width. Another approach would be to measure the key cylinder rotation angle which should be proportional to the nose depth in the cam gate.

From an expert on the internet I learned that this type of safe typically has fixed flies and the cylinder key lock is essentially the handle.

The fixed flies are much cheaper to manufacture. It essentially means that the safe has two different combinations depending on the initial dialling direction. This slightly complicates the standard approach since direction has to be taken into account. I might need to measure the fly width to get a better understanding of the lock.

The key lock being essentially the handle means that to open the safe one would first dial the correct combination and then turn the key to retract the bolts.

The next step is to set up some good way to measure the cylinder rotation and the graph the nose depth (angle) at the cam gate for different combinations.

More soon...

A New Safe a New Challenge

Again I managed to get my hands on an unopened safe from trademe.

This one is small and light which is a nice for a change. I can just put it on my desk to analyse it.

After some internet research I found out that this safe is one of these hotel safes that have a digital combination lock. Next to that is a tubular key lock which is normally covered by a panel which can be removed. This key lock is an overwrite which enables the safe to be opened if the combination was lost or the batteries had died.

The person selling had the safe at his rental property and the tenant went overseas leaving no key or combination. I am quite certain that the safe is mostly empty. When shaking it there is only a very small rattling inside (maybe the key?).

The keypad shows no signs of life (there are 3 LEDs above the keys which stay dark no matter what I press). If anybody has any information or manual for these types of safes (like, how to set a combination,) let me know.

I think that the key lock is the weak part of this safe. If the batteries are empty it might be the only option anyway.

The Locking Mechanism

When reading my blog I noted that it really should be read chronologically since the individual entries relate strongly to each other on the same project. Maybe a blog is the wrong format for this project. Anyway, back to the safe.

I had a close look at the locking mechanism. First I removed the inside cover of the safe door by taking eight screws out. The back cover has been bent open once before to unlock the safe from within through a hole in the bottom of the safe. The paint has chipped of along this bent line and this is clearly visible.

This is the sign on the inside cover of the door.

Taking off the cover exposes the mechanics of the locking mechanism. The door is filled with some type of concrete for fire protection. A metal plate fixed to the concrete is holding the locking mechanism. In this picture the locking bolts are pushed out, the safe would be locked if the door was closed.

There is a grey steel cover over the main part of the combination lock with a small soft piece of metal holding an extra lock up (underneath the grey cover), which would engage if the small metal piece (called trigger) was broken. This is called a relocking device which is mentioned on this sign on the front of the safe:

The idea is that somebody forcing entry will trigger this by either breaking the little metal piece or melting it. The safe would then permanently lock itself and make it impossible to be opened without major mechanical force or very detailed knowledge about the relocking device. Note that in my safe the relocking device has been tampered with and is not installed properly any more. Simply standing the safe upside down would disengage the relocking device. Normally there should be a spring loaded pin in the pivot of the relock arm, that "dead-locks" the lever in place.

I assume that in a previous forceful entry this relocking device was triggered and had to be broken.

In above photo I removed the grey steel cover exposing the brass case that is holding the combination locking device. Next I removed the brass cover:

The brass cover is holding the wheel pack (see photo below). The pin on the top right of the cover presses on a release spring in the brass casing. Only if the brass cover is on the casing the lock automatically disengages when the nose enters the gate. The pin can easily be simulated by pressing the spring with a screw driver. I guess this is another device to make forceful entry into the lock difficult.

The combination lock is a Herring Hall Marvin manufactures lock. The wheel pack consist of three wheels called "hole change" type. Each wheel has holes in increments of 4. The top most wheel and the bottom wheel have even numbers while the one in between has odd numbers. A combination is set by carefully disassembling the wheel pack and putting the grey metal pins in the holes with the desired numbers. The bottom wheel corresponds to the first number to be dialled in the combination and so on. All wheels are different and have to be reassembled in the same order as they were disassembled, otherwise the desired combination wont work. It is therefore very important to test the combination with the door open before locking the safe. Here are some photos of the disassembled wheel pack. Note that the wheels are numbered from 3 the top wheel to 1 the bottom wheel to indicated their corresponding position in the combination.

With this type of lock the starting direction when dialling in the combination is important since the wheels don't have what is called movable flys. The gate and nose configuration is such that the lock will disengage entering from either way. This means that there are two slightly different combinations that will open the safe depending on the starting direction.

Judging by the size of the gates in the wheel pack and the fence (cylindrical in this case) I would guess that there is a tolerance of about 2 to 3 numbers. This means that one could be out by one with each number when dialling the set combination and still open the safe. This safe is in the first instance a fire protection safe and is not regarded as having a high security locking mechanism which explains this tolerance.

Now the interesting thing in my lock is that the numbers selected on the wheels do not correspond to the numbers that open the safe. This most likely indicates that the wheels in the wheel pack have been taken from a different type of lock. Since I have a working combination I know which number in my combination relates to what number in the wheel pack. I can therefore make a lookup table of corresponding numbers for this wheel pack. With this lookup table I can set my own combination. I will try this soon and report back.