Mikes Old Safe

Picked the key lock

noreply@blogger.com (Mike) — Sat, 11 Dec 2010 22:30:00 +0000

I managed to pick the key lock of the safe using these lock picks. Now it only takes me up to 20 seconds to pick that lock. It seems to be a standard cylinder lock with now extra security. The cylinder rotates a few degrees and then stops. When I now turn the combination dial I can feel the key cylinder changing its rotation angle and the dial rotation is hindered by some friction.

A first analysis of the dial indicates a deep depression between 55 and 59. At the moment I assume this to be the cam gate location. Once the notch drops into this I have to turn the key cylinder slightly back to get out of it.This indicates that the cam gate has steep sides and maybe even the lever nose. If that is true I wont be able to measure the lever nose depth by measuring the cam gate width. Another approach would be to measure the key cylinder rotation angle which should be proportional to the nose depth in the cam gate.

From an expert on the internet I learned that this type of safe typically has fixed flies and the cylinder key lock is essentially the handle.

The fixed flies are much cheaper to manufacture. It essentially means that the safe has two different combinations depending on the initial dialling direction. This slightly complicates the standard approach since direction has to be taken into account. I might need to measure the fly width to get a better understanding of the lock.

The key lock being essentially the handle means that to open the safe one would first dial the correct combination and then turn the key to retract the bolts.

The next step is to set up some good way to measure the cylinder rotation and the graph the nose depth (angle) at the cam gate for different combinations.

More soon...

Dong Bang Safe

noreply@blogger.com (Mike) — Thu, 02 Dec 2010 02:29:00 +0000

I managed to buy another locked safe in this TradeMe auction for 30$NZ. This one might work out to be quite a nice challenge.

The safe has a key lock and a combination dial, but no handle. I don't have either the key or the combination.

The manufacturer label came off the dial when I moved the safe:

The label indicates it is from Dong Band Safe Manufacture Co., Seoul. Korea (fantastic name). It is quite small (48cm x 37cm x 38cm) and I can carry it around (less than 30kg). I don't think there is anything in it since nothing rattles or falls around when I turn it over.

Turning the dial I can feel it picking up three wheels. The last wheel adds quite a bit of friction. I can't feel any cam gate, which would indicate that the lever nose (see picture below) is held above the drive cam by the key locking mechanism. This means that the key lock has to be picked first in order to have a go at the combination lock.

This picture is from http://www.crypto.com/papers/safelocks.pdf

I will have a go at it this weekend and post if I make any progress.

No Challenge

noreply@blogger.com (Mike) — Sat, 06 Feb 2010 08:06:00 +0000

After some reading online I figured that picking the tubular lock shouldn't be to difficult. Unlike a cylinder type lock all the pins are nicely accessible. One just needs a good tension wrench.

I found this link on dealextreme which offers a tool that should open the lock in seconds and enables one to make a working key afterwards. I did however pick the lock manually. The first time it took me about half an hour. I used some dentist tools that I had. The safe was empty but for a small screw. The next day I made (with some help) a nice tension wrench and I can pick that lock in 5 minutes now.

The batteries for the keypad can be access from the inside. They had leaked and it took me some time to clean up the mess. However with new batteries the unit sprang back to life. There is a small red button behind the door which enables one to set a new combination.

A New Safe a New Challenge

noreply@blogger.com (Mike) — Thu, 22 Oct 2009 07:39:00 +0000

Again I managed to get my hands on an unopened safe from trademe.

This one is small and light which is a nice for a change. I can just put it on my desk to analyse it.

After some internet research I found out that this safe is one of these hotel safes that have a digital combination lock. Next to that is a tubular key lock which is normally covered by a panel which can be removed. This key lock is an overwrite which enables the safe to be opened if the combination was lost or the batteries had died.

The person selling had the safe at his rental property and the tenant went overseas leaving no key or combination. I am quite certain that the safe is mostly empty. When shaking it there is only a very small rattling inside (maybe the key?).

The keypad shows no signs of life (there are 3 LEDs above the keys which stay dark no matter what I press). If anybody has any information or manual for these types of safes (like, how to set a combination,) let me know.

I think that the key lock is the weak part of this safe. If the batteries are empty it might be the only option anyway.

Kingdom Safe Opened

noreply@blogger.com (Mike) — Mon, 19 Oct 2009 07:13:00 +0000

I have been fairly busy lately and did not manage to update this blog as regularly as I would like to. I opened the safe shortly after the last post. It was empty.

I tried to manipulate the combination dial for a while. I measure the gate width over a range of combinations but found it to be quite constant in width.

The gate is centred around the number 85 and on the side of the safe was a 8 digit number hand written in permanent marker ending in 85. I was therefore quite sure that this number was at least at some stage a valid combination. I therefore tried the combination with different key lock configurations, dialling directions and number of turns in between. And it finally worked and unlocked the safe.

It is slightly frustrating to open safe by means of deducting the combination from reading it of markings on the dial or even written on the safe. I still have not managed to open a safe by means of manipulating the lock.

I took the back panel of the door and had a look at the mechanics of the locking mechanism. I think it should be possible to deduct the nose depth into the gate by reading the angle of the handle. I haven't tried that yet.

I took out the key cylinder and tightened a couple of screws that had come lose, which fixed the problem with the key not coming out.

I cleaned it up a bit and the safe is now back in good working condition.

The new safe arrived

noreply@blogger.com (Mike) — Fri, 18 Sep 2009 03:27:00 +0000

My first impression is that this safe is much heavier. It took two people and a sack barrel to maneuver it into the house and my back is still sore. First, here are some photos:

This is obviously a fire protection safe, the make is Kingdom Safemakers Limited. Which I think is based in Australia. I would say its a fairly recent model.

There are two keys, one of them is in the lock. Both are bent. The key does turn and a click indicates that it disengages some locking mechanism. The key in the lock is stuck and I was unable to remove it so far. The handle next to the key should operate the bolts. It goes down slightly lower when the lock is unlocked (what I assume is unlocked).

The combination lock turns nice and freely, one hears distinct clicks with each disk that is being picked up in the lock. According to the clicks there are three of them. No gate can be felt at any location of the dial. However when pushing down the handle the gate is clearly felt around 85. This means that the handle brings down the nose onto the disks. This does not happen so clearly when the key lock is locked.

Therefore to measure the depth of the nose in the gate one would have to dial in a combination and then return to 85, pull the handle and measure the width of the gate. I tried this but found that the gate kept a very constant width over all samples I took.

Another way would be to measure how low the handle goes, assuming that it directly brings the nose into the gate and therefore indicates the current state of the combination disks.

Another unopened safe on the way

noreply@blogger.com (Mike) — Sun, 13 Sep 2009 08:01:00 +0000

I successfully sold some of the silver from the safe online and reinvested a small amount into buying another unopened safe. I don't think I will find any treasures in this one (I was told by an expert that finding valuables in unopened safes that are sold is a very rare occurrence), but at least will have some fun in opening it. This one has a key and a combination lock. Luckily it comes with a key, which apparently can't be removed. It should arrive in the next few days.

The make seems to be Kingdom and a short search online indicates that they are manufactured in Australia. I will post some photos and more information as soon as the safe arrives.

The Locking Mechanism

noreply@blogger.com (Mike) — Sat, 29 Aug 2009 21:04:00 +0000

When reading my blog I noted that it really should be read chronologically since the individual entries relate strongly to each other on the same project. Maybe a blog is the wrong format for this project. Anyway, back to the safe.

I had a close look at the locking mechanism. First I removed the inside cover of the safe door by taking eight screws out. The back cover has been bent open once before to unlock the safe from within through a hole in the bottom of the safe. The paint has chipped of along this bent line and this is clearly visible.

This is the sign on the inside cover of the door.

Taking off the cover exposes the mechanics of the locking mechanism. The door is filled with some type of concrete for fire protection. A metal plate fixed to the concrete is holding the locking mechanism. In this picture the locking bolts are pushed out, the safe would be locked if the door was closed.

There is a grey steel cover over the main part of the combination lock with a small soft piece of metal holding an extra lock up (underneath the grey cover), which would engage if the small metal piece (called trigger) was broken. This is called a relocking device which is mentioned on this sign on the front of the safe:

The idea is that somebody forcing entry will trigger this by either breaking the little metal piece or melting it. The safe would then permanently lock itself and make it impossible to be opened without major mechanical force or very detailed knowledge about the relocking device. Note that in my safe the relocking device has been tampered with and is not installed properly any more. Simply standing the safe upside down would disengage the relocking device. Normally there should be a spring loaded pin in the pivot of the relock arm, that "dead-locks" the lever in place.

I assume that in a previous forceful entry this relocking device was triggered and had to be broken.

In above photo I removed the grey steel cover exposing the brass case that is holding the combination locking device. Next I removed the brass cover:

The brass cover is holding the wheel pack (see photo below). The pin on the top right of the cover presses on a release spring in the brass casing. Only if the brass cover is on the casing the lock automatically disengages when the nose enters the gate. The pin can easily be simulated by pressing the spring with a screw driver. I guess this is another device to make forceful entry into the lock difficult.

The combination lock is a Herring Hall Marvin manufactures lock. The wheel pack consist of three wheels called "hole change" type. Each wheel has holes in increments of 4. The top most wheel and the bottom wheel have even numbers while the one in between has odd numbers. A combination is set by carefully disassembling the wheel pack and putting the grey metal pins in the holes with the desired numbers. The bottom wheel corresponds to the first number to be dialled in the combination and so on. All wheels are different and have to be reassembled in the same order as they were disassembled, otherwise the desired combination wont work. It is therefore very important to test the combination with the door open before locking the safe. Here are some photos of the disassembled wheel pack. Note that the wheels are numbered from 3 the top wheel to 1 the bottom wheel to indicated their corresponding position in the combination.

With this type of lock the starting direction when dialling in the combination is important since the wheels don't have what is called movable flys. The gate and nose configuration is such that the lock will disengage entering from either way. This means that there are two slightly different combinations that will open the safe depending on the starting direction.

Judging by the size of the gates in the wheel pack and the fence (cylindrical in this case) I would guess that there is a tolerance of about 2 to 3 numbers. This means that one could be out by one with each number when dialling the set combination and still open the safe. This safe is in the first instance a fire protection safe and is not regarded as having a high security locking mechanism which explains this tolerance.

Now the interesting thing in my lock is that the numbers selected on the wheels do not correspond to the numbers that open the safe. This most likely indicates that the wheels in the wheel pack have been taken from a different type of lock. Since I have a working combination I know which number in my combination relates to what number in the wheel pack. I can therefore make a lookup table of corresponding numbers for this wheel pack. With this lookup table I can set my own combination. I will try this soon and report back.

The Origins and Contents of the Safe

noreply@blogger.com (Mike) — Sun, 09 Aug 2009 04:23:00 +0000

After some research on the internet I managed to reconstruct most of the details of how the safe ended up being on an internet auction for me to buy.

In 2000 an American couple bought a holiday home in Christchurch, New Zealand, bringing the safe with them. She tragically died in a car accident in 2006 in Texas. A relative then investigated the safe (which apparently led to the drill holes next to the lock) and wrongly declared it empty. The husband returned to New Zealand in 2008 and got an auction house to auction the contents of the house. This included the locked safe. A local antique dealer bought a number of items, including the safe, on this auction. He tried two locksmiths to open it and eventually gave up, not wanting to spend more money on it. He then listed it on TradeMe a New Zealand internet auction site similar to eBay, where I managed to buy it.

When I finally opened the safe it was full to the brim with things. Most of it were documents, family photographs and other family mementos. Besides that there were two sets of US silver flatware and a collection of bead necklaces.

A few days ago I managed to contact a son of the previous owner. Many of the documents in the safe related to him. He was very pleased to hear that some items thought to be lost were still in existence. He asked me to send him the family photos, mementos and documents, which I did yesterday. He gave me some further background to the safe. It has been in his mothers family since they bought it in an auction in 1977. He still remembers the last combination it had, which is different from the one it has now. He thinks its likely that his mother had the safe opened at some stage due to loss of the combination on her part.

My next plan is to have a closer look at the lock by taking off the inside cover of the safe door. I will report about that as soon as I find the time.

How I opened the safe

noreply@blogger.com (Mike) — Wed, 29 Jul 2009 07:50:00 +0000

The first thing I tried was to follow the instructions given in "Safecracking for the computer scientist". If you are not an expert, you will have to read some parts of it if you want to understand the following in detail.

Essentially there should only one place where you feel a change in resistance when turning the dial, it is called the gate. The gate will be found at the same location each revolution. For this make and model of the combination lock (Sargent & Greenleaf, group 2, three wheel lock) it should be somewhere between the numbers 95 and 15. For a combination lock of this type and if it is in good condition it should be easy to found by feel (not so much sound). The lever nose drops into the gate each turn. If all the other wheels (three in this case) are aligned correctly the lever nose will drop into the gate all the way and enable the unlocking mechanism. The method of manipulating the combination lock (finding out the correct combination) relies on small imperfections of the wheels. Essentially one systematically dials in different combinations and measures how deep the lever nose dropped into the gate. This is done by finding the left and right contact points between the lever nose and the gate (they can be felt). The results are graphed and ideally one number of the combination can be read of that graph. Then a few experiments can indicate which place the number has in the sequence of the combination. The experiment is then repeated in the same fashion, only by presetting that found number while changing the others. If one is able to detect the locations of the left and right contact points accurately and repeatably one should be able to find the correct combination in less than an hour.

Well all that sounds reasonable straight forward, only that my dial was not turning easily and randomly sticking. I was able to find the gate and even get a reasonable idea where the left and right contact points were but a few experiments showed that my measurements were not reliably repeatable. It was just to difficult to turn the deal smoothly and feel the subtle change in resistance.

My next attempt was to apply some WD-40 to the combination lock and that improved things greatly. The dial was now turning smoothly and the change in resistance stood out very well. So I made some safe cracking graph paper and made a few runs of filling them in:

One has to look for where the left and right contact points are the closest to each other. I found some areas of interest and one place around numbers 70 to 75 were there was a big jump in the size (the nose lever is held higher above the gate), but I could not reproduce the areas of interest by closer investigation. Generally I found it difficult to determine the contact points to the required accuracy.

During my time of dialling in different combinations I noticed marks on the knob of the dial.

I had noticed them before, there were two sets of different marks (lines and round holes) with four marks for each of the sets. A safe expert on All Experts had already suggested to me to try these marked numbers. I discounted them since I was sure I only needed three numbers in my combination and it is very hard to tell to which exact number each mark belongs. I found however that the set of round marks had one mark on zero. I discounted the zero mark and rounded the remaining three marks to their closest multiple of 5 numbers. This gave me three numbers to work with for which there are nine different orders of dialling them in. I wrote all nine sequences down and started dialling them in systematically (see this entry on how to correctly dial in a combination). The lever nose clicked very audible into the gate after dialling in my third combination. I turned the handle and the safe opened revealing that is was stuffed full with things.

I will write more about the content and the safe soon. I want to have a look at the combination lock from the inside (see what happens between the numbers of 70 and 75) and maybe even set my own combination.

The safe is open!!!

noreply@blogger.com (Mike) — Mon, 20 Jul 2009 06:31:00 +0000

I opened the safe last night. I don't have much time at the moment, therefore will post details soon.

I opened the safe using the correct combination. Some combinations were marked on the dial and one of them worked.

I heard the lock engage and using the handle pulled back the bolts. To my surprise the safe was completely filled up with stuff:

Most of the left compartment is filled up with silver cutlery. There are necklaces (nothing special I think), photos, documents and other bits and bobs.

I will write more about the contents and the other opening approaches I used later.

Some expert input

noreply@blogger.com (Mike) — Sun, 19 Jul 2009 07:20:00 +0000

I found this site All Experts where experts offer help for free. There is a section for Antique Safes where Andy has great knowledge and advice.

According to him my new safe is from the late 1940s to the mid 1950s. The lock is a HHM three wheel lock, capable of 1,000,000 possible combinations.

A combination, for example 60-25-50, is dialled in by:

4 times left to the first number (60)
3 times right to the second number (25)
2 times left to the third number, (50)
1 time right, slowly until the dial stops (around 95).

Further I found this howto which explains the locking mechanism very well and has an animation of it which clarifies the details. It describes a method of manipulating the lock to obtain the combination, but this section is lacking detail and is incomplete I found.

The missing bits and much more can be found here in "Safecracking for the computer scientist". It gives a detailed account of the inner workings of the combination lock and how to find out the combination.

Closer inspection of the safe

noreply@blogger.com (Mike) — Sun, 19 Jul 2009 06:22:00 +0000

The safe is 50cm wide, 70cm high and 51cm deep. At the top left it says in golden letters:

Herring Hall Marvin Safe Co.
Hamilton Ohio

At the bottom of the door there is a sticker with the same information:

Underneath that there is a plaque that says:

Underwriters Laboratories, Inc
Inspected
Locking Device
Group 1 No 114275

On the top hinge is a serial number:

15542

The combination dial has 100 positions, the knob shows HHM (for the make).

Right from the dial are two drill holes. Drilling into the locking mechanism is a common way of opening a safe. The combination disks can be aligned visually or the opening triggered manually. For this reason some safes have cobalt plates embedded near the lock which is very difficult to drill and requires specialised equipment.

The right hole is only shallow. The left one is about 40mm deep but does not penetrate the locking mechanism. I don't think these holes were successfully used to open the safe.

In the base of the safe a section has been cut out. The outer hull has been cut away, the insulation (concrete) has been removed. Another metal layer beyond that has been cut out and bend to the side. Behind that there is a sheet of metal, which in my opinion, has been put there from the inside to close the hole.

I think somebody got into the safe this way and probably managed to unlock the safe through this hole from the inside. This means if there were any drawers or compartments in there, these would have been damaged in the process. Of course I don't know when that happened, but I don't think I will find great treasures (maybe a business card from a locksmith).
This is the safes weakest point at the moment. The metal sheet could easily be cut away.

The safe arrives

noreply@blogger.com (Mike) — Sat, 18 Jul 2009 02:09:00 +0000

Today the safe was delivered by the seller. It was easier to move than I expected, due to wheels that allow it been pushed sideways. I estimate the weight top be somewhere between 100 and 200kg. I could easily manoeuvre it into the basement.

My first impression is that it looks better than on the pictures. For some reasons the safes surface appears rusty on the photos.

I am publishing more photos of the safe here:
Safe Photos

The seller told me that he bought the safe in an household auction after the owner died in a car accident. The drill marks next to the dial and the cut marks in the base were already there when he acquired the safe.

The make of the safe as stated on it is:
Herring Hall Marvin Safe Co Hamilton Ohio

How I bought the safe

noreply@blogger.com (Mike) — Fri, 17 Jul 2009 01:57:00 +0000

I bought this save on a New Zealand internet auction site beginning of this week:

Safe auction

The seller indicates that the combination to open the safe and the content of the safe are unknown. Further it is clear from the questions and answers in the auction that multiple attempts have been made to open the safe, including drilling and cutting into the base. Wether any of these attempts were successful is unknown.