Crack In Safe - storm-forfree0’s diary

Part 1 of 4: Learning How a Combination Lock Functions

Start with the combination dial. The face of a combination lock is a circular, rotatable dial. Numbers are written around the circumference, usually beginning with 0 at the top and increasing as you turn the dial clockwise. Aside from breaking into the safe which is very hard to do, correctly inputting a series of numbers into the combination dial is the only way to open a safe.

Know how the spindle works. This is a small, simple cylinder attached to the combination dial. When you rotate the dial, the spindle rotates as well.

The spindle and other parts are not visible even with the safe door open.

Know how the drive cam is connected to the spindle. Located on the far end of the spindle opposite the combination dial, this circular object is threaded onto the spindle and rotates with it. 1

A small drive pin extending from the drive cam serves to catch against the wheels see below and set them rotating.

Understand a safe s wheels. Also called tumblers 2, these circular objects encircle the spindle but are not attached to them. They must be caught by the drive pin in order to rotate.

A combination lock has one wheel for each number in its combination typically 2–6. For instance, a lock with a 3-number combination e.g. 25-7-14 has three wheels.

Knowing how many wheels there are is important for cracking the safe, but there are ways to discover this number without knowing the combination see later parts.

Small tabs on the wheel called the wheel fly catch against the drive pin or next wheel and sets them rotating. This term is not important to remember for this guide; just know that the drive cam makes contact with the wheels to set them spinning.

Visualize the fence. The fence is a small rod resting gently atop the wheels. 3 It does not prevent them from turning. The fence is connected to a lever mechanism responsible for keeping the safe shut. As long as the fence remains in place, the safe is locked.

Older texts may refer to this as lock drop, drop-pawl, or dog 4 an obsolete term for any object that holds or blocks another.

Understand how wheel notches come into play. Each wheel has a notch also called a gate at one point along its circumference. When each wheel is rotated so the notch is at the top, the fence falls into those notches. The lever moves, and the door mechanism is unlocked.

You can see why there is one wheel for each combination number. When you dial the first number, the first wheel is rotated to a position with its notch directly below the fence. You then reverse the direction of your rotation to disengage with that wheel and turn the next to its correct position.

The drive cam also has a notch for different reasons. The intended purpose is not important to know for this guide, but remember that this notch will click every time it slips past the lever stationary part attached to the fence.

Extra information for the curious: once the fence falls and releases the locking mechanism, the drive cam notch catches onto the bolt physically blocking the door and pulls it out of the way. 5

Continue to the appropriate section based on your available knowledge. If you already know how many numbers the combination consists of, skip directly to section entitled Testing the Numbers. Otherwise, read on to learn how to Finding the Combination Length.

Part 2 of 4: Finding the Combination Length

Turn the dial several full revolutions clockwise. This will reset the lock and ensure that all wheels are disengaged.

Place a stethoscope near the dial surface. Believe it or not, this Hollywood trope is actually used by professional locksmiths. Placing the stethoscope in both ears and the bell end against the safe wall amplifies the sounds you re listening for.

The mechanism you re listening to is located directly behind the dial, but obviously you cannot cover up the dial since you ll need to turn it. Try moving the stethoscope between different spots adjacent to the dial as you spin the combination until you find the most audible location.

Metal safes reverberate the sounds and make them easier to hear. These are a good choice for a beginning hobbyist.

Rotate the dial counterclockwise and listen carefully for two clicks near each other. Rotate slowly and be ready to note the dial positions. 6

One click will be fainter than the other, since the notch making the sound is sloped toward one side.

You re listening for the sound the drive cam notch makes when it slides under the lever arm 7 see Learn How a Combination Lock Functions. Each side of the notch clicks as the lever passes by.

The drive cam s contact area is the name of the area on the dial face between these two clicks.

Reset the lock again and repeat. Turn the dial several revolutions clockwise, then listen again as you turn slowly counterclockwise.

Clicks can be faint or obscured by other sounds. Repeat the process two or three times and confirming the pattern of two nearby clicks in a consistent small region of the dial face.

Dial counterclockwise until the dial is opposite the sound of the two clicks. Once you ve found the site of the two clicks the contact area, move the dial to the point 180º across from it, exactly opposite the dial face. 8

This is referred to as parking the wheels. You ve placed the wheels in this location and can now count them as you pick them up by turning the dial.

Turn the dial clockwise and listen each time you pass the original point. Turn slowly and pay close attention each time you pass the point you parked the wheels.

Remember to listen when you pass the parked position, 180º from the original contact area you found earlier.

The first time you pass that position, you should hear a click as a wheel is engaged and begins to spin with the drive cam.

Each subsequent time, you will hear a click only if there s an additional wheel to be picked up.

Keep rotating and count the number of clicks you hear. Only count clicks audible in that parked region.

If you hear many clicks or clicks in the wrong position, you may have made a mistake while parking. Try again from the beginning of this section and make sure you are resetting the dial completely by giving it an extra few rotations.

If you are still encountering the same problem, the safe you re using could have anti-cracking technology. You may need to call a professional locksmith.

Write down the total number of clicks. Once you rotate past that point and hear no additional clicks, note the number of total clicks. This is the number of wheels in the combination lock.

Each wheel corresponds with one number in the combination, so you now know how many numbers you need to enter.

Part 3 of 4: Searching for the Combination Numbers

Set up two line graphs. You ll need to record a lot of information in order to crack a safe. Not only are line graphs an easy way to do so, the shape of the graph will aid you in finding the data you ll need.

Label each graph. Each graph s x-axis should cover a span from 0 to the highest number on the dial face, spaced out enough to clearly graph points 3 numbers apart or closer. The y-axis only needs to cover a span of about 5 numbers, but you can leave it blank for now.

Label one graph s x-axis starting position and its y-axis left contact point.

Label the second graph s x-axis starting position and its y-axis right contact point.

Reset the lock, then set it to zero. Spin the dial several rotations clockwise to disengage the wheels, then set it at the zero position.

Rotate slowly counterclockwise and listen. You re trying to find the contact areas where the drive cam connects to a wheel see Learn How a Combination Lock Functions.

When you hear two clicks close together, note the position of the dial at each click. Make sure to note the exact number you heard each click. You ll need to separate points, usually within a few numbers of each other.

Graph these points. On your left contact point graph, make a point at x 0 the number the dial began on. The y-value is the number on the dial where you heard the first click.

Similarly, on your right contact point graph, mark a point at x 0 and a y value where you heard the second click.

You can now label your y-axes. Leave enough room to graph a spread of 5 numbers on either side of the y-value you just recorded.

Reset the lock and set it 3 numbers left of zero. Spin the dial clockwise a few times and set it 3 numbers further clockwise of zero.

This new number is the next x-value you ll record.

Continue recording the location of the two clicks. Find the new y-values of the first and second clicks when you start at this location. They should be near where you heard them last time.

When you ve recorded the second location, reset the lock again and set it an additional 3 numbers counterclockwise.

Keep testing until your line graphs are done. Once you ve mapped the entire dial in increments of 3 and are back at the zero position, you can stop testing.

Look for points on your graphs where the two y-values converge. At certain x-axis points the difference between the left and right contact point values y axis will be smaller. 9

This is easier to see if you lay the two graphs one above the other and literally find the points where the two graphs are closest together.

Each of these points corresponds with a correct number in the combination.

You should know how many numbers there are in the combination, either because you ve used this safe previously or because you followed the instructions for Find the Combination Length.

If the quantity of converging points on the graph doesn t match the quantity of numbers in the combination, make a new graph and see which points are consistently narrow.

Write down the x-values at these locations. If the y-values on the two charts are closest together when x 3, 42, and 66, write down these numbers.

If you successfully followed these steps, these numbers should be the ones used in the combination, or at least close enough to work.

Note that we do not know which sequence of these numbers is the correct one. Read on for additional testing and tips.

Part 4 of 4: Testing Your Results

Try every possible sequence of the numbers you located. If you wrote down 3, 42 and 66 at the end of Search for the Combination Numbers, test the combinations 3,42,66 ; 3,66,42 ; 42,3,66 ; 42,66,3 ; 66,42,3 ; and 66,3,42. One should open the safe.

Remember to attempt to pull open the safe door after each complete combination. You don t want to be absent minded and move on to the next combination before checking for success.

Remember to reset the dial between each attempt by spinning it several times.

If your dial has more than 2 or 3 wheels, you ll probably want to write down each combination in advance and cross them out as you go.

Try combinations using adjacent numbers if the safe won t open. Most safes allow for a 1 or 2 number margin of error while dialing, which is why you only needed to test every 3rd number. It s possible your safe is more exact, especially if it is more expensive.

For example, if the digits you wrote down are 3, 42, and 66, you ll need to try every combination of 2, 3, or 4 41, 42, or 43 65, 66, or 67. Don t get confused and start testing combinations like 41, 42, 65 ; each combination should contain exactly one number from each bracketed trio.

This is really only practical for a 3 digit combination or less requiring a maximum of 162 attempts. For a 4-digit combination, the number balloons to a maximum of 1,944 attempts. This is still much faster than trying every possible combination, but will waste a lot of time if it turns out you made an error in your cracking attempt.

Try again from the beginning. Cracking a safe takes a lot of patience and effort. Find the Combination Length, Search for the Combination Numbers, and Test Your Results all over again.

Keep your old graph and notes handy. If your new attempt gives the same partial results for instance, 2 of the 3 numbers are the same ones you tested before, it s much more likely those results are accurate.

We could really use your help.

Can you tell us about

home improvement.

home improvement

how to install paving stones

horses.

horses

how to begin horseback riding

credit cards.

credit cards

how to use a credit card responsibly and effectively

singing.

singing

how to sign using your diaphragm

Things You ll Need

Stethoscope

Graph paper and pencil

Several hours minimum

Tips

Try to find a blueprint of your safe s model if you can. Knowing exactly how a safe is constructed is especially useful if you resort to sawing through see warnings.

Warnings

Don t set off an explosive inside a safe to try to open it. Even if you succeed, you will destroy the contents.

Prying open the bolts and door will take an extreme amount of force and time for a good safe. 10 Prying open the hinges alone is not sufficient. 11

A circular saw, or oxy-acetylene torch may take a very long time to cut through a safe. More advanced safes are made of higher-grade material, contain heat-dissipating copper shields, or even hide booby traps for the unsuspecting safe breaker. 12

The more high-security and modern the safe is, the more likely it is to include additional barriers to safe cracking. For instance, false notches to produce misleading clicking sounds. If you re taking up safecracking as a hobby, start with an antique safe or a low quality inexpensive modern one. 13.

Safecracker redirects here. For the 1997 video game, see Safecracker video game. For the 2006 sequel, see Safecracker: The Ultimate Puzzle Adventure. For the Bally pinball game from 1996, see Safecracker pinball.

Safe-cracker redirects here. For Life on Mars episode, see The Safe-Cracker Life on Mars.

Safe cracker redirects here. For German Luftwaffe Aircraft, see Hs-129.

A safe with destroyed electronic components

Safe-cracking is the process of opening a safe without either the combination or key.

Contents

1 Physical methods

1.1 Lock manipulation

1.2 Guessing the combination

1.3 Autodialers

1.4 Weak-point drilling

1.5 Scoping

1.6 Brute force methods

1.7 Radiological methods

1.8 Tunneling into bank vaults

1.9 Safe bouncing

2 Media depictions

3 See also

4 References

5 External links

Physical methods edit

Different procedures may be used to crack a safe, depending on its construction. Different procedures are required to open different safes so safe-crackers need to be aware of the differences.

Lock manipulation edit

The most surreptitious way of cracking a safe is to manipulate the lock in order to obtain the combination required to open the safe without actually damaging the safe.

Some rotary combination locks can be manipulated by feel or sound in order to determine the combination required to open the safe. More sophisticated locks use wheels made from lightweight materials which reduces this vulnerability. Another anti-manipulation mechanism is serrated wheels false tumbler notches that make tactile techniques much more difficult. Another defence is a clutch-type driver wheel that prevents contact of the fence to the tumblers except in one position. These locks can be identified by a click-click feeling in the dial or by a dial that is pushed in and turned. Manipulation is the locksmith s preferred choice in lost-combination lockouts, since it requires no repairs or damage, but can be extremely time consuming due to lock improvements over the years, and is also a difficult art to master. There are also a number of tools on the market to assist safe engineers in manipulating a combination lock open. These generally fit directly on to the locks dial and assist in being able to accurately read the left and right contact points of the locks drive cam.

Some combination padlocks can also be manipulated by pulling and applying leverage on the shackle while turning each dial to determine the combination required to unlock them.

In the absence of any other information regarding the safe s combination, a combination lock may be opened by dialing every possible combination. Many combination locks allow some slop in the settings of the dial, so that for a given safe it may be necessary only to try a subset of the combinations. 1 Such slops may allow for a margin of error of plus or minus two digits, which means that trying multiples of five would be sufficient in this case. This drastically reduces the time required to exhaust the number of meaningful combinations. A further reduction in solving time is obtained by trying all possible settings for the last wheel for a given setting of the first wheels before nudging the next-to-last wheel to its next meaningful setting, instead of zeroing the lock each time with a number of turns in one direction.

Guessing the combination edit

Further information: Password cracking

Safes may be compromised surprisingly often by simply guessing the combination. This results from the fact that manufactured safes often come with a manufacturer-set combination. These combinations known as try-out combinations are designed to allow owners initial access to the safes so that they may set their own new combinations. Sources exist which list manufacturers try-out combinations.

Combinations are also unwittingly compromised by the owners of the safes by having the locks set to easy-to-guess combinations such as a birthdate, street address, or driver s license number.

Autodialers edit

A number of companies and groups have developed autodialing machines to open safes. Unlike fictional machines that can open any combination in a matter of seconds, such machines are usually specific to a particular type of lock and must cycle through thousands of combinations to open a device. A good example of such a device is a project completed by two students from the Massachusetts Institute of Technology, Kyle Vogt and Grant Jordan. Their machine, built to open a Sargent and Greenleaf 8400 lock on a Diebold Safe, found an unknown combination in 21,000 tries. 2 Lockmasters, Inc. markets two autodialing machines that work on a variety of 3-digit combination safe locks. 3

There also exist computer-aided manipulation tools such as Mas Hamilton s SoftDrill no longer in production and Cygnus. These tools are like autodialers except they listen to the lock and, with the aid of a computer, make logical decisions like a human manipulator would. 4

Weak-point drilling edit

Safe-drilling w/ drill rig

While some safes are hard to open, some are susceptible to compromise by drilling or other physical methods. Manufacturers publish drill-point diagrams for specific models of safes. These are tightly guarded by both the manufacturers and locksmithing professionals. Drilling is usually aimed at gaining access to the safe by observation or bypass of the locking mechanism. Drilling is the most common method used by locksmiths, and is commonly used in cases of burglary attempts, malfunctioning locks or damaged locks.

In observational attacks, the drill hole allows the safecracker to view the internal state of the combination lock. Drill-points are often located close to the axis of the dial on the combination lock, but observation may sometimes require drilling through the top, sides or rear of the safe. While observing the lock, the locksmith manipulates the dial to align the lock gates so that the fence falls and the bolt is disengaged.

Bypass attacks involve physical manipulation of the bolt mechanism directly, bypassing the combination lock.

All but the simplest safes are designed to protect against drilling attacks through the implementation of hardplate steel extremely wear-resistant or composite hardplate a casting of metal such as cobalt-vanadium alloys with embedded tungsten carbide chips designed to shatter the cutting tips of a drill bit within the safe, protecting the locking mechanism and other critical areas such as the locking bolts. The use of hardplate ensures that conventional drilling is not successful when used against the safe. Drilling through hardplate requires the use of special-purpose diamond or tungsten-carbide drill-bits. Even then, this can be a time-consuming and difficult process with safes equipped with modern composite hardplates.

Some high-security safes use what is called a glass relocker. It is a piece of tempered glass mounted between the safe door and the combination lock. It has wires attached to the edges. These wires lead to randomly located, spring-loaded bolts. If an attempt is made to penetrate the safe, the penetrating drill or torch breaks the glass and releases the bolts. These bolts block the retraction of the main locking bolts. To drill a safe with a glass relocker, side, top, or rear drilling may be necessary. Many modern high-security safes also incorporate thermal relockers in conjunction with glass-based relockers usually a fusible link as part of the relocker cabling, which also activate when the temperature of a safe exceeds a certain level as a defense against torches and thermal lances.

Drilling is an attractive method of safecracking for locksmiths, as it is usually quicker than manipulation, and drilled safes can generally be repaired and returned to service.

Punching, peeling and using a torch are other methods of compromising a safe. Peeling involves removing the outer skin of the safe.

Plasma cutters and thermal lances are hotter than oxyacetylene torches and can be used to burn through the metal on a safe.

Scoping edit

Scoping a safe is the process of drilling a hole and inserting a borescope into the safe to get an intimate look into a specific part of the security container. When manipulation proof mechanical locks, and glass re-lockers are implemented as security measures scoping is the most practical option. One common method is called scoping the change key hole. The safecracker will drill a hole allowing him to get his scope into a position to observe the change key hole. While spinning the dial and looking through the change key hole for certain landmarks on the combination lock s wheel pack, it is possible to obtain the combination and then dial open the safe with the correct combination. This method is common for a professional safe specialist because it leaves the lock in good working order and only simple repairs are needed to bring the safe barrier back to its original condition. It is also a common way to bypass difficult hard plates and glass re-lockers since the change key hole can be scoped by drilling the top, side, or back of the container.

Brute force methods edit

Other methods of cracking a safe generally involve damaging the safe so that it is no longer functional. These methods may involve explosives or other devices to inflict severe force and damage the safe so it may be opened. Examples of penetration tools include acetylene torches, drills and thermic lances. This method requires care as the contents of the safe may be damaged. Safe-crackers can use what are known as jam shots to blow off the safe s doors.

Most modern safes are fitted with relockers like the one described above which are triggered by excessive force and will then lock the safe semi-permanently a safe whose relocker has tripped must then be forced, the combination or key alone will no longer suffice. This is why a professional safe-technician will use manipulation rather than brute force to open a safe so they do not risk releasing the relocker.

Radiological methods edit

Penetrating radiation such as X-ray radiation can be used to reveal the internal angular relationship of the lock s internal mechanism to deduce the combination. Modern safe locks are made of lightweight materials such as nylon to frustrate this technique, since most safe exteriors are made of much denser metals. The Chubb Manifoil Mk4 combination lock actually has a lead shield surrounding part of the lock to defeat such attempts to read its wheels.

Tunneling into bank vaults edit

Large bank vaults which are often located underground have been compromised by safe-crackers who have tunneled in using digging equipment. This method of safe-cracking has been countered by building patrol-passages around the underground vaults. These patrol-passages allow early detection of any attempts to tunnel into a vault.

Safe bouncing edit