Forensic Locksmithing: Reading Tool Marks After Entry

Definition

Don Shiles, a former president of the International Association of Investigative Locksmiths (IAIL), defined forensic locksmithing as "the study and systematic examination of a lock or other security device or associated equipment using scientific methods to determine if and how the device was opened, neutralized, or bypassed." The examinations, in that definition, can include microscopy, photography, physical disassembly, and laboratory techniques such as metallurgy and tool-mark identification.

Datagram's lockpickingforensics.com summary of the field adds that the forensic locksmith "does not solve cases for the investigative agency, rather they provide facts, evidence, and insight," and lists supporting knowledge areas that include locksmithing, crime-scene work, photography, microscopy, evidence handling, and report writing and testimony.

History

Art Paholke of the Chicago Police Department is widely called the father of forensic locksmithing. Lockpickingforensics.com places his crime-lab research in the 1970s: he studied how different methods of attack changed locks, safes, and keys, and how wear affected the marks those methods left. A DEF CON 17 white paper by Datagram dates the start of that work to 1976. A commercial history by Anderson Lock gives Paholke's dates as 1927–2002 and notes that he was a Navy-trained locksmith who became a Chicago PD sergeant. Pin and Ward hedges the start date to "the 1970s" and treats 1976 as one published figure, not a settled consensus.

What Tool Marks Can Show

The common belief that non-destructive entry leaves no trace is false. TOOOL Netherlands states that picking tools "make scratches in the lock in places a key would never come into contact with," scratches that can be seen with the naked eye. The same page reports that SSDeV, the German locksport association, opened five test locks for the German federal forensic laboratory, which then identified the technique used and roughly how many times the locks had been opened.

Peer-reviewed work reaches the same conclusion at the tool-mark level:

• Plumtree (1975). In the Journal of Forensic Sciences, W. G. Plumtree of the Los Angeles Criminalistics Laboratory wrote that few studies had been published on marks left by lock picks, and that "certain methods of picking locks can be detected." The paper's purpose was to show what can be learned from pick marks on cylinder locks.
• Volkov et al. (2014). Also in JFS, a study of an H&M Mul-T-Lock picking tool concluded that an examiner can identify the class-characteristic mark of that specific tool and distinguish it from traditional picking-tool marks and from regular key marks.

Those findings support the forensic claim. They are not instructions for making or hiding marks.

Standards Context

Lock and tool-mark examination sits next to broader forensic standards. ANSI/ASB Standard 162 (2024), Standard for the Forensic Examination and Documentation of Non-firearm Tools and Non-firearm Toolmarks, "provides procedures for the examination, documentation, and reporting of non-firearm tools and non-firearm toolmarks by forensic toolmark examiners." It does not cover microscopic comparison of toolmarks. Lock-specific work still relies heavily on trade practice, case experience, and the research literature above.

The Lock Industry Standards and Training (LIST) Council's dictionary distinguishes entry by the evidence it leaves: forced entry leaves obvious damage; covert entry can be detected only by disassembly or detailed inspection; surreptitious entry cannot be detected that way. Forensic locksmithing is the practice of checking which of those claims holds for a given scene.

Professional Role and Certification

Forensic locksmiths identify method class, tool class, skill indicators, and the relative security of the hardware. Agencies use those reports to corroborate timelines and capability—not as sole proof of identity.

SAVTA's Proficiency Registration Program, working with the CFL Committee of IAIL, offers forensic safe-technician designations including Certified Forensic Professional Safe Technician (CFPST) and Certified Forensic Master Safe Technician (CFMST). IAIL certifications require recertification every three years. See safecracking for the broader safe-technician certifications (CPS, CMST).

Ethics

Investigators need to understand entry methods in order to recognize their marks. Publishing those methods as how-tos is a different activity. TOOOL Netherlands requires permission: members are "to only open locks that you have permission for to open from the owner." This encyclopedia page stays on the investigative side of that line. It does not discuss how to avoid leaving marks.

Related Topics

• Lockpicking
• Key bumping
• Impressioning
• Bypass
• Safecracking
• Locksport
• Decoding

Sources