Forensics: Difference between revisions
(Created page with '=Forensic Locksmithing= '''Forensic locksmithing''' (or '''investigative locksmithing''', '''forensics''') is the study of the forensic evidence left behind by different entry t…') |
mNo edit summary |
||
| (8 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
=Forensic Locksmithing= | =Forensic Locksmithing= | ||
[[File:Forensics_pin_picked.jpg|thumb|right|text-top|240px|Forensic evidence left on a [[pin-tumbler]] by [[lockpicking]] tools.]] | |||
'''Forensic locksmithing''' (or '''investigative locksmithing''', '''forensics''') is the study of the forensic evidence left behind by different entry techniques on [[lock]]s and [[safes]], as well as surrounding areas such as [[door]]s, windows, and walls. [[Locksmith]]s who provide forensic services are referred to as forensic or investigative locksmiths. | '''Forensic locksmithing''' (or '''investigative locksmithing''', '''forensics''') is the study of the forensic evidence left behind by different entry techniques on [[lock]]s and [[safes]], as well as surrounding areas such as [[door]]s, windows, and walls. [[Locksmith]]s who provide forensic services are referred to as forensic or investigative locksmiths. | ||
The forensic locksmith assists investigative agencies in criminal investigations, insurance claims, and security maintenance by providing the facts surrounding the compromise of a lock or [[key]] system. In this regard, the forensic locksmith identifies the method of entry, tools used, skill level of attacker(s), the relative security of the system, and evidence that may be used to identify suspects. The forensic locksmith does not solve cases for the investigative agency, rather they provide facts, evidence, and insight that may be used to affect the outcome of an investigation.<ref>[http://www.lockpickingforensics.com Lockpicking Forensics | The forensic locksmith assists investigative agencies in criminal investigations, insurance claims, and security maintenance by providing the facts surrounding the compromise of a lock or [[key]] system. In this regard, the forensic locksmith identifies the method of entry, tools used, skill level of attacker(s), the relative security of the system, and evidence that may be used to identify suspects. The forensic locksmith does not solve cases for the investigative agency, rather they provide facts, evidence, and insight that may be used to affect the outcome of an investigation.<ref>[http://www.lockpickingforensics.com/forensic_locksmithing.php Lockpicking Forensics - Forensic Locksmithing]</ref> <!-- Douchey, but I have no other sites to reference :( [[User:Datagram]]--> | ||
__TOC__ | __TOC__ | ||
| Line 9: | Line 11: | ||
== History == | == History == | ||
Art Paholke of the Chicago Police Department is considered the father of forensic locksmithing. In the 1970s, working in the crime lab, he researched various methods of attack against locks, safes, and keys. He would look at each attack to determine what it changed and what evidence it could provide. He also examined the ways in which wear of the cylinder affects marks left by various attacks. Many modern techniques and procedures used by forensic locksmiths are credited to the research and innovations of Mr. Paholke. | |||
<!-- TODO Add Method of Entry section and related non-cat pages --> | |||
== Forensic Evidence == | == Forensic Evidence == | ||
All [[Destructive entry|destructive]] and [[Covert entry|covert]] methods of entry leave some form of forensic evidence. The latter leaves evidence that is not normally detected by normal users but can be discovered by a trained forensic locksmith. Attempts to conceal evidence from both types of entry methods is usually done through repair or replacement of affected components. This in itself may leave forensic evidence, as well. | |||
; [[Lockpicking]] | |||
: Scratches along the pin-tumblers, plug walls, and [[actuator]] are common. It is extremely difficult to pick a lock with traditional tools without leaving any scratches. See [[#Anti_forensics|Anti forensics]] below. | |||
; [[Key bumping]] and [[Pick gun]]s | |||
: Impact marks along the base of the tumblers are present, as well as marks on the [[plug]] walls and pin chambers. Each type of impact leaves a different tool mark, including a distinction between manual and electric pick guns. With key bumping, distortion to the keyway caused by the shoulder and bow of the key may also be present. | |||
; [[Decoding]] | |||
: Varied evidence is left by decoding depending on the tools and techniques used. Common "pick" decoders leave evidence similar to traditional lockpicking attacks. Many forms of decoding are also surreptitious. | |||
; [[Impressioning]] | |||
: In copy-based impressioning, trace evidence on the source or duplicate keys may be found, such as wax, clay, or silicon. Keys made via copy impressioning are generally made of a weak, low-melting point metal, which is also suspect. Manipulation based impressioning leaves various shear marks on the components. Pressure responsive techniques also leave various types of trace evidence, such as foil or lead. Excessive torque applied during manipulation based impressioning may also distort various components, such as the pin chambers in a [[pin-tumbler]] plug. | |||
; [[Bypass]] | |||
: Traditional attacks against the locking [[bolt]] or [[actuator]] leave distinct tool marks on these components. Tool marks on these components are generally suspect because these components rarely interact directly with the key or locking components. Some methods of bypass are surreptitious, and others destructive. The specific tools and techniques used will determine the type of forensic evidence left behind. | |||
; [[Destructive entry]] | |||
: Varied evidence is left by the destruction of a lock, safe, door, wall, window, or surrounding areas. Destructive entry is detectable by normal users. | |||
== Anti forensics == | |||
Anti-forensics are tools and techniques that attempt to evade forensic detection. All [[surreptitious entry]] techniques are technically anti-forensics, though improper preparation or use of these tools and techniques may cause them to inadvertently leave evidence. | |||
[[File:Lockpicking_Fiberglass_pick.jpg|thumb|left|text-top|150px|A fiberglass lockpick.]] | |||
=== Non-steel lockpicks === | |||
The use of non-steel [[Picks|lockpicks]] is a common idea. Plastic, rubber, or similar materials would, in theory, not leave marks on the brass or nickel-silver components of most locks. The overriding problem with these tools is that they are hard to make, and extremely hard to use.<ref>datagram. 2009. [http://www.lockpickingforensics.com/articles/keystothefarm.pdf Anti-Forensics: The Keys to the Farm].</ref> Most are weak and provide little feedback during lockpicking.<br clear=all> | |||
=== Glue gun shoulder (key bumping)=== | |||
The shoulder of a key can be replaced with one made of soft rubber, such as a glue gun stick. This mitigates damage done to the face of the lock but does not prevent forensic evidence on the pin-tumblers, pin chambers, or plug walls. | |||
== References == | == References == | ||
<references /> | <references /> | ||
== External links == | |||
* [http://www.iail.org International Association of Investigative Locksmiths (IAIL) homepage] | |||
* [http://www.lockpickingforensics.com Lockpicking Forensics homepage] | |||
== See also == | == See also == | ||
| Line 25: | Line 65: | ||
* [[Lockpicking]] | * [[Lockpicking]] | ||
[[Category:Locksmithing]] | |||
[[Category:Locks]] | |||
Latest revision as of 18:19, 23 November 2011
Forensic Locksmithing
Forensic locksmithing (or investigative locksmithing, forensics) is the study of the forensic evidence left behind by different entry techniques on locks and safes, as well as surrounding areas such as doors, windows, and walls. Locksmiths who provide forensic services are referred to as forensic or investigative locksmiths.
The forensic locksmith assists investigative agencies in criminal investigations, insurance claims, and security maintenance by providing the facts surrounding the compromise of a lock or key system. In this regard, the forensic locksmith identifies the method of entry, tools used, skill level of attacker(s), the relative security of the system, and evidence that may be used to identify suspects. The forensic locksmith does not solve cases for the investigative agency, rather they provide facts, evidence, and insight that may be used to affect the outcome of an investigation.[1]
History
Art Paholke of the Chicago Police Department is considered the father of forensic locksmithing. In the 1970s, working in the crime lab, he researched various methods of attack against locks, safes, and keys. He would look at each attack to determine what it changed and what evidence it could provide. He also examined the ways in which wear of the cylinder affects marks left by various attacks. Many modern techniques and procedures used by forensic locksmiths are credited to the research and innovations of Mr. Paholke.
Forensic Evidence
All destructive and covert methods of entry leave some form of forensic evidence. The latter leaves evidence that is not normally detected by normal users but can be discovered by a trained forensic locksmith. Attempts to conceal evidence from both types of entry methods is usually done through repair or replacement of affected components. This in itself may leave forensic evidence, as well.
- Lockpicking
- Scratches along the pin-tumblers, plug walls, and actuator are common. It is extremely difficult to pick a lock with traditional tools without leaving any scratches. See Anti forensics below.
- Key bumping and Pick guns
- Impact marks along the base of the tumblers are present, as well as marks on the plug walls and pin chambers. Each type of impact leaves a different tool mark, including a distinction between manual and electric pick guns. With key bumping, distortion to the keyway caused by the shoulder and bow of the key may also be present.
- Decoding
- Varied evidence is left by decoding depending on the tools and techniques used. Common "pick" decoders leave evidence similar to traditional lockpicking attacks. Many forms of decoding are also surreptitious.
- Impressioning
- In copy-based impressioning, trace evidence on the source or duplicate keys may be found, such as wax, clay, or silicon. Keys made via copy impressioning are generally made of a weak, low-melting point metal, which is also suspect. Manipulation based impressioning leaves various shear marks on the components. Pressure responsive techniques also leave various types of trace evidence, such as foil or lead. Excessive torque applied during manipulation based impressioning may also distort various components, such as the pin chambers in a pin-tumbler plug.
- Bypass
- Traditional attacks against the locking bolt or actuator leave distinct tool marks on these components. Tool marks on these components are generally suspect because these components rarely interact directly with the key or locking components. Some methods of bypass are surreptitious, and others destructive. The specific tools and techniques used will determine the type of forensic evidence left behind.
- Destructive entry
- Varied evidence is left by the destruction of a lock, safe, door, wall, window, or surrounding areas. Destructive entry is detectable by normal users.
Anti forensics
Anti-forensics are tools and techniques that attempt to evade forensic detection. All surreptitious entry techniques are technically anti-forensics, though improper preparation or use of these tools and techniques may cause them to inadvertently leave evidence.
Non-steel lockpicks
The use of non-steel lockpicks is a common idea. Plastic, rubber, or similar materials would, in theory, not leave marks on the brass or nickel-silver components of most locks. The overriding problem with these tools is that they are hard to make, and extremely hard to use.[2] Most are weak and provide little feedback during lockpicking.
Glue gun shoulder (key bumping)
The shoulder of a key can be replaced with one made of soft rubber, such as a glue gun stick. This mitigates damage done to the face of the lock but does not prevent forensic evidence on the pin-tumblers, pin chambers, or plug walls.
References
External links
- International Association of Investigative Locksmiths (IAIL) homepage
- Lockpicking Forensics homepage
