Tough Lock

Combination locks are fascinating devices.  Each one, in its own way, is a little magic box that contains a secret. If you have the password, you are welcome to come in.  If you don’t, well then, tough luck.

Several years ago, I lost the combination for my bicycle lock, but eventually, I figured it out using brute force. (See my Picking Locks post for details.)

           

Walking home recently, I passed by several discarded boxes of items on a street corner and noticed a shiny combination lock on the top of the pile.  Wow, I thought! Why would anyone discard a perfectly good, relatively new combination lock?



Unlike my bicycle lock which had several combination disks, this lock had a single dial. I picked it up and tried to pull open the bolt, but no luck, it was in the locked position. So I turned it over to see if the combination was written on the back but it wasn’t.  I know some lock manufacturers can provide a lost combination if you have the serial number, but alas, this lock had no serial number either.

Well, I guessed, that would explain why it had been discarded. Someone must have locked it, forgotten the combination, and then couldn't open it ever again. What good is a lock that can’t be used?

When I got home, I checked several online combination lock resources.  Most of them showed how to open a lock using a variety of methods such as force or shimming, and one source even provided an accelerated brute force attack method. But none provided a fast way to recover a lost combination.
Following the motto: “no matter how difficult, every problem has a solution”, I proceeded to disassemble the lock and see if I could find a way to recover the combination.

An examination of the back of the lock revealed that it had been sealed by pressing down the casing over the backplate.  This packing method is similar to how restaurants close aluminum take-out food containers.

I fixed the lock in a vise and slowly unfolded the crease using a knife and holding down the back plate. Once the crease was straightened, I pulled off the back plate.


The removal of the back plate revealed a second plate. This one had several holes and notches in it (see image above).

Using needle nose pliers, I gently pulled out the notched plate out of the casing. I finally had access to the interior of the lock. YES!



Combination Lock Parts List: B: Lock bolt
C: Hasp retainer clip
D: Back plate
E: Cylindrical lock body
F: Interior plate (used to carry two commination disks and support the interior parts)
G: Spring loaded clasp
H1:Combination disk
H1:Combination disk
I1: Compression spring (to keep the two combination disk properly spaced)
I2: Plastic retainer clip
J1: Plastic retainer clip
J2: Plastic retainer clip
K: Combination dial
L: Combination disk (attached to the inferior body of part E and directly connected to Part K)
M: Alignment grove in L combination disk
The notched plate was holding two combination disks (parts H1 and H2 ). The combination disks were attached to a metal shaft with plastic retainers (part J1 and J2), a plastic spacer I1, and a spring I1.

The cylinder body of the lock had several parts as well. It contained:

1. The third combination disk (part L) which was connected to the number dial (part K).
2. A long U-shaped solid metal bar (part B)
3. A retainer (part C)
4. A spring loaded hinge with a notch (part G)
    

The lock mechanism turned out to be little more complex than what I had expected. Part B, the U shaped metal bar (lock bolt), was held in position by a notch located on part G.

The only way for that notch to move out of the way and allow the bolt to be released was for the small tab in part G to be aligned with groove M (see below).



I also noticed that part L had a little tab dimple.  It was connected to the number dial (part K) that was rotated in order to select the lock combinations. This dimple was responsible for driving the two combination disks (parts H1-H2) when rotating to the left and right. Apparently, the dimple on part L engaged similar dimples present on parts H1 and H2.

By now, I had a pretty good understanding of how the lock worked. When the user rotated the dial on the face of the lock to the first number, it aligned the M grove with the G notch. Next, when the second number was dialed, the H1 grove aligned with the G notch. Then, when the third number was dialed, the notch on H2 was aligned with the G notch.  Now all the disc had their groves aligned with the G notch which allowed the B bolt to be pulled.

So the combination for this lock (or any other combination lock) is governed by the locations of the dimples on the combination disks. Pretty ingenious if you ask me!
Ok, so now I knew how the lock worked, but how do you translate the locations of the dimples on the combination disks to the actual combination numbers? 

The answer eluded me for several days until it finally occurred to me: why not drill a view hole and watch the combination disks align? I started with the first combination disk rotating it until it was aligned with the notch on part G.  I marked the number that was shown on the dial (part B) and then repeated this maneuver two more times for the other numbers.

After this step, I reassembled the lock and proceeded to try the combination. I held my breath and pulled on the bolt and heard the sweet clicking sound of the disengaging latch. VICTORY!
This posting is dedicated to Richard Feynman, the ultimate lock pick master and the inventor of the shimming method.