Lockpicking Forensics

The act of using a pick tool is invasive, and we expect the stronger material of the pick tool to cause marks on the softer brass or nickel-silver of the lock components. In this photo, we see scratches where the pick tool was used to lift the pin. These appear to be single-pin picking marks due to their shape and consistency.

This photo is similar to the last, but instead there are many varied, elongated scratches at different angles and depths on the pin. This type of marking is indicative of a pick that is designed to be gently rubbed against the pins at varying height and tension. Of course, this is the technique known as raking or rake picking.

In this photo, marks left appear to be a combination of both picking techniques. Many attackers will attempt to lightly rake as many pins as possible and then proceed to use single-pin picking against the rest. This may be necessary in the case of security pins that are triggered while raking, also.

The marks left by an attacker are in many ways indicative of their skill level. In this photo, extremely deep and plentiful pick marks are shown. The attacker, an amateur, used extreme force on both tension and pick tools. The extreme tension causes pins to bind against plug and require more force to be lifted.

This is a very skilled attacker who uses extremely light tension and picking force to reduce forensic evidence. Despite skill, we still find similar forensic evidence. In this photo, pick marks are extremely light but still visible in the center of the pin. We can also see some marks on the side of the pin which are more defined.

There are many other designs of pin-tumbler besides the standard round or pointed tips. This is a photo of a Mul-T-Lock telescoping pin tumbler that uses an inner and outer pin stack. Both show signs of picking tools. If we separate the pins, we would also probably find picking marks on the inside chamber of the outer pin.

Some pin tumbler designs are rather strange, designed to deter manipulation. This photo shows a Vachette VIP "nippled" pin. The design of this pin is rather complex, with not only a nippled tip but also a very spool like appearance. In any event, picking marks are visible along the nipple and base of the pin.

Forensic evidence is also left behind by various lock-specific tools, which are growing more common with high-security locks. In this photo, the pick marks from a Medecoder type tool are visible in the sidebar channel where the tool was used to rotate the bottom pin.

For the attacker, it is difficult to not touch the sides of pins. This can happen during raking as well as single-pin picking. Marks left on the sides of pins are quite noticeable and not as prone to wear and those in the center of the pin. In the photo, light scratches at varied angles are visible.

In the case of low-high pinning combinations it is even harder to lift pins without touching the sides of other pins. In this photo, a series of long scratches travel up the side of the pin. Interestingly, we may be able to measure the length of scratches to determine if the attacker raised the adjacent pin high enough.

Like the bottoms of the pins, the sides can tell a great deal about the skill level of the attacker. In this photo, gouges on the sides of the keys are rather deep, caused by extreme force being used on both the tension and picking tools. With this much material removed, it may be possible to identify pin material on a suspect's possessions.

The movement of the pick through the keyway also leaves forensic evidence in several places. The most common is on the walls of the plug itself. In this photo, scratches left by the pick tool are found below the pin chambers on the walls of the plug. The scratches are at various angles inconsistent with the use of a key.

One of the best places to look in the plug is at the top of the keyway. The key will never touch this area, so it is one of the few "virgin" areas in the lock. In this photo, we can see that there are light scratches along the area before the first chamber, probably from the use of a tension tool at the top of the keyway.

Marks on the warding inside of the plug are also common. Normal use of keys does not usually cause these marks, but if they are indeed the cause marks should be present on several other wards, as well. In this photo, a deep gouge has been made by the pick tool on one of the wards deep inside the plug.

Marks may also be left in the pin chambers themselves. In this photo, we see a mark on the left side of the pin chamber. This area of the plug cannot be touched by the key and pins would not make a mark like this unless they were severely deformed. Compare with the chamber wall on the right.

We might find pick marks higher in the pin chambers, too. These areas are subject to wear as pin stacks are moved by the normal action of the key. In this photo, an up-down-up patterned scratch is seen. This is probably caused by the attacker lifting and lowering the pin stack, trying to find the shear-line.

Forensic evidence of the tension tool can also be identified rather easily, especially if the attacker is a beginner or amateur lockpicker. The act of putting tension on the plug causes the tool to lightly shear the plug walls. In this photo, we can see the gouges left by the tension tool being placed at the bottom of the keyway.

Destructive disassembly of the plug lets us get a better picture of tension tool marks. In this photo, we can see that there is a deep gouge where the tension tool was actually used, as well as several scratches below it. The scratches are likely from positioning of the tool or tapping it with the picking tool while picking.

In the case of a skilled attacker, very light torque is applied to the tension tool. It may be more complicated to identify marks without proper lighting, but even in this example, where low tension was used, the tension tool marks can be identified when they are properly illuminated.

The cam may also have marks because many attackers, when navigating the back of the plug, will hit the cam. This is especially true of less controlled techniques like raking. In the photo, a light scratch is present in the center of the cam, a place the key normally does not touch.

One of the problems as an amateur is knowing where the pick is. It is common to see many amateurs with the tip of the pick poking out of the cylinder. When the cam is on, this may translate into extreme scratching on the back of the cam, as seen in this photo. Similar marks may be left by some forms of bypass.

The question always arises as to how we can determine when pick marks were made or how long it takes normal wear to remove them. In this photo is the first pin from a lock that has been picked once. We will use this as a reference to see the effects of wear after 250 uses.

After 250 uses (roughly 2-4 months use) the tip of the pin has been worn by the key, leaving fewer distinct picking marks. At the same time, the sides of the pin still show very clear and distinct picking marks. This is because the key does not touch these areas as frequently and may never, depending on the key bitting.

While taking the last photo I noticed a strange shape in the top right of the photo. When I refocused in that area I found this. It appears to be a small piece of brass that has transferred to the tip of the pin, probably a very small fragment of the key. Quick, call the crime lab!

Carbon fiber lockpicks were considered for use in Anti-Forensics, but my research shows that they leave marks similar to traditional metal lockpicking tools. The photo shows a finished carbon fiber lockpick in the half-diamond design. This pick is roughly 0.025" thick.

Carbon fiber picks did not work as well as I had hoped. Most importanly they fell short of surreptitious by leaving marks on pin-tumblers similar to traditional tools. In this photo, light scratching along the tip and side of the pin can be seen, caused by a carbon fiber lockpicking tool.

Carbon fiber lockpicks also seem to grab and hold pin materials much better than their metal counterparts. In the photo, a carbon fiber pick is shown with brass residue from the pins of a lock it has picked. This can be used in court as evidence to link a suspect to a crime.

Also considered for Anti-Forensics were fiberglass based lockpicking tools. My research shows that these are also unsuitable because they leave distinct forensic evidence on the pins and inside the plug. In this photo, a half-diamond fiber glass pick is shown. This pick is roughly 0.028" thick.

Fiberglass also left various traces similar to traditional metal lockpicking tools. In this photo, parallel scratches at various angles and positions can be seen on the bottom and side of the pin-tumbler. All marks were cause by the fiberglass picking tool.

Fiberglass is also less surreptitious than carbon fiber because the act of picking and raking the lock leaves behind a sizeable amount of fiberglass on the pin-tumblers and walls of the plug. In this photo, fiberglass residue can be seen on the tip of the pin-tumbler.

Like carbon fiber picks, fiberglass does a very good job of trapping trace evidence from the pin-tumbler inside the lock onto the pick. In this photo, the tip of the fiberglass pick is shown with light brass residue and lubricant (black) clearly visible.