One lock, fully interrogated
The idea is to extract every single bit of knowledge possible from a single lock by approaching it with a variety of different methods. I am very new to manipulation, but I'm going to put myself out here and risk making silly mistakes in a public forum because I think the project will be fun and I always learn faster when I approach a new subject methodically and in great detail. For each new manipulation I will do entirely new graphs and I will fully document any additional tests such as High/Low or amplification. I will be calling this the “Full Interrogation” of the lock (term borrowed from a Mark Bates interview). So without further ado, here is our lock:
Group 2, 3 wheels
[center]
This lock was purchased on eBay and was advertised as having been a store display. It certainly looks like one because it was already on a plastic mount complete with a slightly damaged change key. I doubt this lock has ever been used in any other capacity. It’s nice and clean on the inside and there are no obvious signs of wear. In case anybody notices and wonders about it, I have bent the relocking spring out of the way to disable the relocking mechanism.
Right Contact Point: 7
Width of Contact Area: 8¾
(Measurements taken with all wheels parked at L50)
Manipulation #1
All Wheels Left Method
In this manipulation I discovered the previously unknown combination. In future manipulations of this lock in the “Total Interrogation” series I will continue using the same combination so that various approaches to the lock can be directly compared under the same circumstances.
The first manipulation of the lock will be a traditional all wheels left approach measured in increments of 2½ and measuring to ¼ of a dial mark. Here's the graph.
I found two good looking indications at 20 and 72½ with some suspicious activity between 45 and 55. The area between 45 and 55 didn’t look like enough for me to bother with right away because I had two good indications to investigate, but I kept it in mind for the future just in case.
The next step I took was to amplify the two indications so as to zero in on the correct numbers. I went back to the indications and tested each number individually instead of just checking every 2½ numbers. Here are the results:
Amplifying L20:
17.0 – LCP 98.00 – RCP 7.00 – CA 9.00
18.0 – LCP 98.25 – RCP 6.75 – CA 8.50
19.0 – LCP 98.50 – RCP 6.75 – CA 8.25
19.5 – LCP 98.50 – RCP 6.75 – CA 8.25
20.0 – LCP 98.50 – RCP 6.75 – CA 8.25
20.5 – LCP 98.50 – RCP 6.75 – CA 8.25
21.0 – LCP 98.50 – RCP 6.75 – CA 8.25
21.5 – LCP 98.00 – RCP 7.00 – CA 9.00
As you can see I got a little paranoid part of the way through and started checking every ½ number. I've been burned before because I wasn't sufficiently careful while amplifying an indication. I found a 3 dial-mark wide area from 19-21 with a clearly low reading. Looks like a gate to me!
Amplifying L72.5
70.0 – LCP 98.00 – RCP 7.25 – CA 9.25
71.0 – LCP 98.50 – RCP 6.75 – CA 8.25
71.5 – LCP 98.50 – RCP 6.75 – CA 8.25
72.0 – LCP 98.50 – RCP 6.75 – CA 8.25
72.5 – LCP 98.50 – RCP 6.75 – CA 8.25
73.0 – LCP 98.50 – RCP 6.75 – CA 8.25
73.5 – LCP 98.50 – RCP 6.75 – CA 8.25
74.0 – LCP 98.00 – RCP 7.25 – CA 9.25
The indication showed up as 3.5 dial-marks wide (from 71-73.5) so I split the difference, rounded up to the nearest half and called it L72.5. If this turns out to be wheel 2 I’ll translate that into a right oriented number.
The next task was to determine which gates relate to which wheels. Following are the results of my tests. I decided to use a High/Low test first since that’s what I usually do. The test was done on L20 and L72.5 using +/- 10 numbers.
High test on L20:
w1&2 @ L20 / w3 @ R30
LCP 97.75 – RCP 7.25 – CA 9.50
w1&3 @ L20 / w2 @ R30
LCP 98.25 – RCP 6.75 – CA 8.50
w2&3 at L20 / w1 @ R30
LCP 98.50 – RCP 6.75 – CA 8.25
Low test on L20:
w1&2 @ L20 / w3 @ R10
LCP 98.50 – RCP 6.75 – CA 8.25
w1&3 @ L20 / w2 @ R10
LCP 98.25 – RCP 6.75 – CA 8.50
w2&3 @ L20 / w1 @ R10
LCP 98.25 – RCP 6.75 – CA 8.50
The High/Low test on L20 was inconclusive. The high test indicates that L20 belongs to w3, but the low test shows that w3 is the least likely to own L20. The two tests directly contradicted each other, even after double and triple-checking for errors. It just goes to show that High/Low tests are fraught with peril.
High test on L72.5:
w1&2 @ L72.5 / w3 @ R82.5
LCP 98.50 – RCP 6.75 – CA 8.25
w1&3 @ L72.5 / w2 @ R82.5
LCP 98.50 – RCP 6.75 – CA 8.25
w2&3 @ L72.5 / w1 @ R82.5
LCP 98.50 – RCP 6.75 – CA 8.25
Low test on L72.5:
w1&2 @ L72.5 / w3 @ R62.5
LCP 98.00 – RCP 7.00 – CA 9.00
w1&3 @ L72.5 / w2 @ R62.5
LCP 98.75 – RCP 6.50 – CA 7.75
w2&3 @ L72.5 / w1 @ R62.5
LCP 98.75 – RCP 6.50 – CA 7.75
Here, the high test showed nothing of use, but the low test couldn't be clearer. L72.5 clearly indicates for wheel 3. It's easily seen here that when wheel 3 was at L72.5 there was a smaller contact area and when it was not at L72.5 there was a larger contact area. At the same time, there is nothing in the high test that contradicts that conclusion.
I decided to do a little more investigation since this is a “Full Interrogation”. This time I parked all three wheels at a low spot on the graph (R35) and did another test using that low area as a baseline. Then I brought wheel 3 over to the two indicating area’s to compare them against the baseline. Here are the results.
All wheels @ R35 (baseline test – low area of graph)
LCP 98.25 – LCP 6.75 – CA 8.50
w1&2 @ R35 / w3 @ L20
LCP 98.28 – LCP 7.00 – CA 8.75
w1&2 @ R35 / w3 @ L72.5
LCP 98.25 – RCP 6.75 – CA 8.50
The indication got worse when w3 was on L20, but remained the same when it was on L72.5. This gave more credence to the conclusion that L20 was not the combination number for w3 but it still wasn't very convincing.
In the spirit of a Full Interrogation I tried yet another approach to investigate the different indications on wheel 3. I had already tried comparing the two indications against a baseline in a low area of the graph, but what would happen if I compared them against a baseline in a high area of the graph? Here are the results.
All wheels @ R60 (baseline test – high area of graph)
LCP 98.00 – RCP 7.00 – CA 9.00
w1&2 @ R60 / w3 @ L20
LCP 98.25 – RCP 7.00 – CA 8.75
w1&2 @ R60 / w3 @ L72.5
LCP 98.75 – RCP 6.50 – CA 7.75
Voila! That made three tests assigning L72.5 to wheel 3 and one test that was inconclusive but could have been interpreted to mean that L20 belonged to wheel 3. Considering that one weird test was the first one I did, I'm glad I continued to investigate in greater detail.
The next thing I considered was what to do about the indication at L20. The high/low test on L20 was weird so I disregarded it. I decided to do the same "baseline" tests for w2 as I did for w3 except with w3 on its gate. Here are the results.
Low baseline test:
w1&2 @ R35 / w3 @ L72.5
LCP 98.50 – RCP 6.25 – CA 7.75
w1 @ R35 / w2 @ L20 / w3 @ L72.5
LCP 99.00 – RCP 6.25 – CA 7.25
High baseline test:
w1&2 @ R60 / w3 @ L72.5
LCP 98.75 – RCP 6.50 – CA 7.75
w1 @ R60 / w2 @ L20 / w3 @ L72.5
LCP 98.75 – RCP 6.25 – CA 7.50
It looked like I had another winner! On both tests I got a clear improvement when placing w2 on L20 so I concluded that this was the gate for wheel 2. On this lock changing from a left oriented number to a right oriented number adds .5 so L20 became R20.5.
Now that I had two numbers, I got dialing.
L50 - R20.5 - L72.5
What did I learn?
I learned to really dig in and investigate each indication. Remember that “suspicious activity between 45 and 55” that I supposedly kept in mind for future use? Well I forgot all about it. This was a failure to fully interrogate the lock. I should have investigated it when I was done with looking into L20 and L72.5. It turns out I had every single gate showing up clearly in my first graph.
I learned that if you take readings at enough points on the dial, you can actually paint a picture of the drive cam gate. If you look at the amplification of L20 above, I was taking readings pretty close together and captured the gradual descent of the nose against the left contact point. It read 98, then 98.25, then 98.5.
I am more and more wary of High/Low tests in general. They seem to introduce an element of randomness to the process by arbitrarily parking wheels at some set distance from the indication being investigated. Why 10 dial marks? Why not 5, or 12, or 57? The state of the wheel pack 10 numbers away from the indication is going to be totally different from lock to lock, and from combination to combination in the same lock, so why use it as a standard? What seems to be happening is that you are comparing an unknown datum (the indication you are investigating) to an unknown datum (the state of the wheel pack at an arbitrarily assigned number of steps away from your indication) and hoping to arrive at useable data.
I just came up with the "high baseline" and "low baseline" tests on the fly and I don't know if that technique already exists somewhere under a different name. I have seen people on the forums “park wheels in a low area” so maybe this is the same thing. I will continue using it to determine if it's actually consistent but I cannot believe that it is less valid than a High/Low test. I imagine it must be more consistent since you are comparing an unknown datum against a known datum. That’s a big step up from comparing one thing you don’t know about to another thing you don’t know about. You already know from the graph what the state of the wheel pack is at the points you are comparing your indications to, so you can see if there are departures from that state and to what degree.
I apologize if I'm coming off as arrogant here or if I'm stepping on anyone’s favorite technique. I'm more than willing to be proven wrong on my distrust of the High/Low test or on the validity of the tests I just came up with and I will happily eat crow if it results in my having a better understanding of these locks and the techniques used to manipulate them. I am really new to this so I'm sure I'll embarrass myself somewhere along the line
Am I doing the high/low tests wrong? If there's more to it or I'm applying the technique incorrectly I really want to know.
Do the “low baseline” and “high baseline” tests I threw together already exist under another name? I’m willing to bet there are people out there who already came up with this idea and either use it or have discarded it for valid reasons.
Is the fact that I found all three gates on the first graph unusual? I thought it was almost a certainty that you would only find one gate at a time and that exceptions to this were very rare.