Cracking a Brinks 5059 safe today!

[PhoneMan]

My cousin has a Brinks safe she lost the combo to, but fortunately she remembers 2-3 of the four numbers, so brute forcing might not be so hard.
This is the first safe I've ever tried to seriously crack, so I'm anxious to try my hand at it.

Thankfully she has the key, and she described it as a dimple key, so at least I won't need to pick it! I also explained the possibility I might need to drill it, and If I do, I'll be posting in BPDE for info on that.

Any pointers anyone could give me? (If you want to PM the info to keep it off here, that's fine) And if this needs to be moved to BPDE, i'm cool with that too.

[PhoneMan]

Here it is, I couldn't get it open!

I tried turning the key as I rotated the dial, and I can get feedback from it, but the gates didn't line up.
We found a 1800 number for Brinks, and apparently if you give them the serial and key #'s and sign a form then get it notarized, Brinks will give you the combo! I advised her to go that route, instead of destroying the safe by prying or drilling on it.

[fgarci03]

What did you try to do?

You are only 1 or 2 numbers short aren't you_

[PhoneMan]

I was turning the dial while applying tension on the key, in hopes to catch the gates. I could feel one or two gates catch, but couldn't get any farther. I also tried dialing the #'s in various order. (She didn't remember what order the numbers were in) she had 3 numbers out of four, and wasn't sure of 2 of them, so brute forcing seemed daunting!

Apparently the key acts as the handle and pushes the fence into the gates when they are aligned. There was one spot around 80 where it felt really deep, and I thought that might be the last number. I am still really new to manipulation, and don't understand how the graphing works or how to go about it.
I can usually get the really cheap safes open by applying pressure to the handle and spinning the dial back and forth, unfortunately on this one, that didn't work.

[GWiens2001]

Good for you for giving it a go! You will get better. Just opens my first closed safe two days ago. Before this, it was all mounted safe locks. It was a sentry, so no big deal. It was also direct entry, but used a handle rather than a key.

Gordon

[fgarci03]

Hmm..

I'm also new to manipulation, but I'll try to be of some help.
First of all, if there are 4 numbers, there must be 4 wheels, what makes it evil

It probably has false gates too.

Do you know how to make and use a pointer?
If you tape a stick to the key (min 1 feet) and tape a piece of paper with some sort of scale on it in the safe, where the end of the stick is (the scale must be precise enough for you to check the different depths of the fence entering the gates - 1mm should be enough), you can measure how much the fence enters the wheels. Where it goes deeper is the real gate.

Then you need to work the wheels in a way you know which number corresponds to each wheel. For starting, my approach would be to pick up just the first wheel and rotate it slowly, taking note of where it goes deeper. Then choose the gate where it went deeper. If there isn't a deeper one and are several the same depth, chose one and take note of all of them, you'll have to come back to it later. Then after a full revolution, pick up wheel 2 and map it the same way. Ditch the gates that you found on wheel 1 unless they go deeper this time. Do that for all wheels. You may be stepping on some false gates anyway, so you'll have to test different combinations (hence taking note of all the false gates, and which wheel they belong to, you'll have to test them all) and check when they go deeper and deeper untill it opens. Don't forget the rotation of the dial on each wheel. A R55 is different from a L55.

All of this is assuming a perfect lock that binds the wheels in the best orientation possible.

If not, which is probably th case, you'll have to park the wheels somewhere, and test each number with 2 or 2,5 increments at a time. So an example would be:
- you are testing wheel number 2. So start dialing and pick up the 4 wheels. Stop at 0 (for example) to park W1. dial the other way around to pick up wheel 2 (so 3 turns, as you have to pick up 3 wheels) and place in the number you want to test, then other way around and place W3 at 0, then the same for W1. Rotate the key and take note of where the pointer stops. Do the same with 2 or 2,5 increments for wheel 2, always leaving the other wheels at the same place, to have consistent readings. Check the deepest gate, etc, etc, etc.

If the wheels are unsimetrical or oval, it will get much harder.

Note that I've never done this before. This is pure logic coming out of my head, based on my next to none knowledge in these locks. I'm hoping some of the old guys confirm or correct what I'm saying, both to help you with this, and to help me, as I'm going to be in front of a safe like that in a week or 2!


Here's an image for the pointer

This was made using a pick because he had no key, but it's the same. Just use something longer to be easier to check the diferences. A bike spoke is perfect (thin the tip for more precise readings)

You can also use a rubber band to have a constant pressure on it (hold it to the handle or something) so you wont have to be always rotating the key by hand, allowing for incorrect readings...

Hope this is of some help, and that someone corrects my crappy guide (I can think of 4 people right now, so bear with me )

[MrWizard]

The gate that obvious went in deeper would be the last wheel directly attached to the dial called the drive wheel or cam I would say. You could check that by turning both ways and see it hits the same spot on the dial when turned 360 degrees right then left. That would be the last number in the combo. If you checked what that number was and isn't one of the 2 she remembers you are only 1 number away from getting it open. But would have to determine which wheels those numbers she remembers are. Can mark how far the key is turned with that drive wheel lined up and try her numbers as the first and second number see if the key turns more etc. Each time you try to find another gate or check her numbers return the drive wheel back to it's number then check how far the key turns. But since she got it new and can use the Brinks hot line to get the combo that is the way to go for sure.

Richard

[Oldfast]

What a fun adventure! Have you been able to revisit it lately? Made any headway?
I wish I could be of some help, but direct entry type locks I've VERY little experience with.

About the only thing I would maybe suggest is starting the manipulation fresh with no assumptions.

....(She didn't remember what order the numbers were in) she had 3 numbers out of four, and wasn't sure of 2 of them....

You could certainly have a play with some of these numbers... but she doesn't sound all too certain.
Pursuing things like this can sometimes cost you ALOT of additional time with no reward at the end.

[PhoneMan]

My cousin got the combo from Brinks, and it wasn't ANY of the numbers she had! Go figure! Well, it was still a happy ending, and I'm still going to play with manipulation in my spare time.

[Mcof]

I'm a little late, but I have a similar model (5055) and details.



The spindle turns the wheel furthest from the door which also functions as the drive cam. It is significantly larger than the other wheels so while this is technically a 4-wheel lock it is functionally a standard 3-wheel.



Because the distance from the punch to the gate varies on each side of each wheel these locks are probably set using a selection of pre-punched wheels at the factory. Strangely there is also a pin on the cam that changes the offset, perhaps a relic of a manufacturing change.



This is one of the smoothest locks I've encountered since the spindle is essentially a 2-inch-long bearing and the fence is completely disengaged



As for manipulation, the theory is to use a pointer on the key as fgarci03 described. In practice this design actually makes that quite difficult. The bolt-fence assembly is controlled by the pin at the bottom so any reactive force from the wheel pack at the top will torque the whole thing and cause it to shift unpredictably. It would have to be done using either a very light touch or multiple rounds to knock out some of the error. On the bright side, the 'free' fourth number lets you feel exactly how wide the gates are so the increments are known.

Naturally I lost the combination at some point. What I learned is that It's very easy to make an autodialer for this specific lock because the fence can be dragged until the rotation stops in a known location, making slippage a non-issue.

[CPT1911]

Great breakdown, Mcof! I've seen very few gut shots of DE locks so I really appreciated this.

I was surprised there were no false gates on this wheel pack? I would think that having only a true gate would make arrival at a gate very easy to detect when putting pressure on the key? But I have truly zero experience manipulating DE locks of any kind.

Are there sentry locks that don't have false gates as well?

Trevor

[bitbuster]

i have come across sentry safes with no false gates.these are the early models. these sentry's have the BRASS wheels and nonremovable metal dial. they are out there.