start	end	text
1370	7230	Welcome to Safe Cracking for Everyone! A little bit about myself, who am I? My name is Jared
7230	12650	Digert. I'm a lock support enthusiast, gamer, rock climber, game developer, and I've been picking
12650	19370	locks and cracking safes for about a decade now. So this talk is going to cover how Group 2 safe
19370	27270	locks work, and mechanical combination safe locks are divided into two groups. There's Group 2s,
27270	33170	which is your basic safe lock, no anti-manipulation features in them, also the most common type,
33170	37750	and then there's Group 1s, which are more complicated and include various different
37750	44730	measures to keep people from figuring out the combination. Now, whether you buy a $500 safe
44730	51910	or a $5,000 safe, if it comes with a mechanical safe lock, it will most likely be a Group 2 safe
51910	59570	lock. Very rarely are there Group 1 safe locks that come by default on a safe. Usually you have
59570	66570	to pay hundreds of dollars extra for the lock, even more to get it installed, and this is not
66570	72290	very common at all. So I'll be covering these Group 2 safe locks in this talk. I'll cover the
72290	77590	flaws in this design and how to exploit them, along with specific techniques that is used to
77590	83150	crack the combination. And at the end, I'll cover some slight differences between various Group 2
83150	89390	safe locks, since not all manufacturers create them the same way. First thing is knowing the
89390	94610	parts of the lock. So this is the back of the lock with the back cover removed, and you can see that
94610	100590	there is a silver lever here. Now, the end of this lever has a protrusion, and this protrusion is
100590	108250	called the nose. This nose is resting on a brass wheel. The brass wheel is called a drive cam,
108650	115730	and this drive cam, you can see, has a cutout in it. This space, this empty space in the drive cam,
115730	124270	is called the contact area. You can see where the cutout starts on either end, and those are the
124270	131910	contact points. So the cutout is the contact area, and each end of the cutout, where it starts, is the
131910	139190	contact points. And this drive cam is controlled directly by the dial. So there's a metal rod, you
139190	143770	can see, in the middle, and that connects it directly to the dial. It's locked in place with
143770	151490	this key. So whenever you turn the dial, the drive cam moves at the same time with the dial.
152270	158790	Behind the drive cam, you can see a larger silver wheel. There's three of these wheels, generally,
158790	164550	in each lock. Sometimes there could be four, but most often times it's three. Now, this wheel that
164550	171130	we see here is called wheel three. It's the third wheel. It's closest to the drive cam, and when
171130	177770	you're in front of the lock, it would be furthest away from you. And the other two wheels are behind
177770	184810	it. Now, each of these wheels are exactly the same. There is a cutout in each of these wheels
184810	193780	called a gate. Now, these gates are part of when you dial the combination.
194810	204550	The gates all line up, and there is a metal bar behind this lever, and it lines up all of these
204550	210930	gates under the metal bar when you dial the correct combination. So that when you turn the dial
210930	217150	and the drive cam, so the contact area is under the nose, everything can fall down and fit nice
217150	225150	and easily. So here, you would just continue turning the dial, and that would pull in this lever,
225150	230530	and that retracts a bolt. The lever is attached to the bolt, and that pulls it in so that you
230530	238350	can turn the handle and open the safe. The handle of a safe just pulls in the outermost bolts around
238350	244610	the edge of the door so that you can open it, but the lock itself only locks the handle. So that's
244610	250870	basically how safes operate. It's a locking mechanism locks the handle, and the handle is
250870	258190	what pulls in the bolts from the outer edge of the door. Now, to demonstrate that,
258930	264690	I have a lock here, and if we look at the back, you can see the drive cam.
265050	270870	Whenever I spin the dial, the drive cam moves with the dial.
272150	280930	So if I were to dial in the combination, that would involve putting the gate of the first wheel
281890	290190	under the fence, and then I would put the gate of the second wheel under the fence as well. I messed
290190	300010	that up, but I will just fix it. And then I put the gate of the third wheel under the fence. I simply
300010	307270	turn the drive cam so everything can fall in, and then that will retract this bolt when I continue
307270	321900	turning. Now the way that it works is each of these wheels has a protrusion on one side, and
321900	329920	that fits into a groove of the next wheel. Now this protrusion will ride in this groove as the wheel
329920	337460	spins until it hits this metal piece of the next wheel, at which point this next wheel will start
337460	345380	to spin along with the previous wheel. And this wheel also has a protrusion which rides in a groove
346020	354560	of the wheel next to it, and then after a whole rotation it will hit this metal bit, and then the
354560	360880	next wheel will start to spin along with the rest of the wheels, essentially picking up each wheel
360880	367560	after each rotation. So the drive cam has that sort of
369920	375160	protrusion as well. So right now everything is spinning together, but if I were to spin the other
375160	381620	way, you can see it is only the drive cam spinning until I make one full rotation, and then this third
381620	388200	wheel, the wheel closest to the drive cam, starts spinning with it. So the third wheel gets picked
388200	395700	up first, and then after another full rotation, you can see that the second wheel starts to get
395700	402920	picked up as well, and it is spinning along with it. After another rotation, then this third wheel,
402920	408600	or this first wheel, gets picked up as well. And the wheels are named this way because the first
408600	413980	wheel corresponds to the first number in the combination. Since it is the last to get picked up,
413980	423780	then it is set first. So then you can freely mess about with the other two wheels without upsetting
424380	430020	the position of that first one. So the third wheel gets picked up first, corresponding to the third
430020	440110	number in the combination, then the second wheel, and then the first wheel. Now the standard opening
440110	445310	procedure for a lock is to spin four times with left rotation to the first number, which means
445310	451470	you pass the first number three times, and you stop on the fourth. Then you reverse directions,
451470	457050	because if you were to keep going, it would mess up the position of the first wheel. So you reverse
457050	465290	direction, spin three times with right rotation, so now we are turning clockwise to the second
465290	471150	number. And then you do that three times. So you pass the second number twice, stop on the third
471150	476750	time, and then twice with counterclockwise rotation, so we are reversing rotation again
476750	482890	to the final number. We pass it once, and then we stop on the second time. Then we turn right until
482890	490010	the bolt is retracted. Now the reason for this is because you have to spin three times to ensure all
490010	496550	the wheels are picked up. You don't know the state of this wheel pack when you approach the lock,
496550	503150	so it could be someone spun it to the right all the way before you approached it. So you want to
503150	511690	make sure you spin one full rotation will pick up that third wheel, two full rotations picks up the
511690	518510	second wheel, and then three full rotations ensures that that first wheel gets picked up. So we just
518510	525910	pass the first number in the combination three times. So now we have to go to it and stop on the
526550	531890	fourth time. We reverse directions because otherwise it would mess up the position of that
531890	538670	first wheel. So we do one full rotation, pick up the third wheel, two full rotations, now we pick up the
538670	548210	second wheel, and so we pass the second number twice, and we stop on the third time. And I overshot
548210	555190	it again. Reverse directions, one full rotation picks up the third wheel, and then we stop on the second
555190	567370	time. And then we can turn right so everything drops in and the bolt retracts. Here's a really
567370	573490	bad drawing. I mislabeled this. This is wheel two in the middle. So the dial will turn the drive cam
573490	580870	until this protrusion picks up wheel three, and then after rotating for some time, wheel three
580870	587070	will pick up wheel two, and then wheel two after rotating will pick up wheel one, and so then they'll
587070	595290	all start spinning together. There's a lot of vulnerabilities in this design. So you can see here
595290	602310	when none of the numbers are dialed in correctly, and then we turn the drive cam, we turn the dial
602310	609890	so that the contact area is under the nose. That allows the fence to drop down onto the
609890	616590	wheel pack, essentially testing it for the correct combination. But the thing is, these wheels,
616590	622530	they're not perfectly circular, and they're not the same size as each other. Some will be bigger,
622530	627330	some will be smaller, and some will have bumps and dips, and that's because of manufacturing
627330	635830	tolerances. It's basically impossible to get rid of these imperfections. What this means is,
635830	642550	since one of these wheels is bigger, the fence is not going to be resting on all of the wheels at
642550	650450	the same time. You can see here, between wheel three and the fence, there's actually a bit of space.
650450	658150	It's not touching. Wheel two here, you can see, is larger than wheel three and wheel one. This fence
658150	666650	is only touching wheel two. Now, we can also see that this contact area, where the contact points
666650	675370	are on either end, it is sloped to go down. And that means there is less wiggle room, so to speak,
675370	682810	between the sides of the contact area the further down you go. So let's assume that wheel two,
682810	689770	let's pretend that the wheel two combination is valid, that the gate for wheel two is now under
690490	695710	this fence. Well, what would happen? Well, this fence would not rest on wheel two anymore. It would
695710	702570	drop down ever so slightly and rest on wheel three. That means this nose would be lower in the
702570	711630	contact area and there's less wiggle room between the contact points. The really cool thing about
711630	724410	this is you can feel this on the dial. So if I were to reset this, you can see that the nose drops
724410	730790	into the contact area when it's over the contact area and that allows the fence to rest onto
731610	742170	the wheel pack. So if the largest wheel has the gate under the fence, this nose is lower. And so
742170	747430	this wiggle room, you can feel this bit of resistance. You can feel each contact point
748010	758290	from the dial. That wiggle room would be less. So the contact points, about 96 for the left one,
758290	767090	we name it from viewing the dial. So the more sloped side here on the left in this view
767090	771790	is the right contact point because from the front of the safe, that's the right.
772530	780570	Oops. So this left contact point is about 96 and the right contact point is about 3.
780910	788510	But if perhaps two of the wheels were dialed with the gate under the fence, we might feel this at
788510	798970	98 and 2. Thus the closer contact points, less wiggle room. So that is a major vulnerability
798970	806650	and the main thing we use in order to determine the combination. So we can know through this
806650	813090	when one of the gates, when the gate of the largest wheel is under the fence simply because
813090	820610	there will be less wiggle room between the contact points. So the first step is finding
821050	828210	a number in the combination with this information that we now have. So what we do is we have to take
828670	836010	a series of test combinations every two or two and a half numbers. The tolerances of these locks
836010	842590	sometimes allow you to go every two and a half, but generally it is safer just to go every two
842590	851310	numbers. And there are two contact points, the left and the right, but as shown earlier the right
851310	860050	contact point is more sloped. So there will be a greater change in the amount of wiggle room
861170	866890	from the right contact point. The left will move in a little bit, but not as much as the right.
867250	872550	So we really only need to know what the right contact point is at any given time.
872550	879810	And you can graph this as well. So if I get my graph paper right here,
880830	887990	you can see this is a basic layout of a graph. So along the top we have 0 to 100, and then here I
887990	894930	put the closest whole number to the left contact point, one above and one below. Same thing with
894930	901390	the right contact point, one above and one below. And as I mentioned, you don't really need the left
901390	908470	contact point, but it is good supporting evidence if the right contact point is not really giving
908470	915130	clear readings, which we will cover later. So you can graph both of the contact points like this.
915130	925350	So first thing is you want to turn the dial left three times to pick up all of the wheels,
925350	932110	and then stop on the first reading. So we can just say we're going to try zero. Now the reason
932110	939470	we spin left and we pick up all the wheels with left rotation is because the combination is found
939470	945150	or is dialed with left, right, and then left rotation. So left to the first number, right to
945150	953530	the second, and then left to the third. So if we find a number, it's kind of random. We don't really
953530	958090	know which wheel is going to be at first, right? We just know one of the wheels is larger than the rest,
958090	966690	and we want to figure out when that wheel has a gate under the fence. So it's just,
967210	971810	you know, statistics that it's going to be more likely the first and the third rather than
971810	979270	the second. Also, because of the way the locks are designed, wheel three would generally be larger or
979270	985590	would be the wheel that makes contact with the fence first. So that's more evidence to start with
985590	993910	more reason to start with left rotation first. So what we do is we spin the dial, pick up all the
993910	999210	wheels with left rotation, and then we stop at our first test combination. So in this case that would
999210	1005390	be zero, zero, zero. So we stop at zero. And then what we do is we want to reverse directions because
1005390	1010070	if we were to keep going that would mess up the position of the wheels. So we reverse directions
1010070	1017670	until we get within the contact area. So remember our contact points are 96 and 3, so we want to
1017670	1022610	spin left until we're within that. We don't want to pass zero, because remember after one full
1022610	1031650	rotation we pick up the third wheel. So we just want to go between zero and three, and then you
1031650	1038330	just spin. I accidentally passed it but we'll ignore that for now. You want to gently spin the dial
1038330	1044450	left until you hit the contact point. And you don't want to ride up on it. You don't want the nose to
1044450	1053690	ride up onto the drive cam. You just want to go lightly and stop when you feel that bit of
1053690	1064530	resistance. And then you can record that. So on the graph at zero down to three, let's say we feel at
1065380	1074130	two and seven eighths. Then you can mark that from here two and seven eighths for zero. Okay so that
1074130	1082050	can be about here. And that is also really important, is you want to be able to differentiate
1082690	1089990	between one eighth of an increment. And that's really hard to show on camera here for this
1089990	1095450	because it's not really precise, and also the resolution of the camera. But you want to be able
1095450	1102490	to look at the dial and know whether it is showing like a two and seven eighths, or a three, or a 35
1102490	1109310	and one eighth, or a 35 and two eighths. And you want to be able to accurately record that.
1109310	1115350	Because what we're looking for is a change of a one quarter increment. So we want to make sure
1115350	1120810	that our measurements are taken with a precision of one eighth of an increment just to be safe.
1128280	1131860	So we're going to pretend that we did this for the entire
1136180	1145480	I guess all the numbers of the of the safe. So if I were just to fill it in just with some
1147860	1164330	random points, and I'm just putting a generic reading here. And as stated earlier, you can
1164330	1170150	record the left contact point here as well. It's just that it's not going to be as much of a variation.
1171410	1178950	So here, essentially what we're doing is we are taking the overall shape of all the wheels of
1178950	1187530	the wheel pack, and we're just laying it out in a line. So if this were to be cut into a strip of paper
1188030	1193850	and put into a circle, this is what the wheel pack would look like on a very fine scale.
1194330	1199790	Because remember, they're not perfectly circular. So on a very fine scale, there's a lot of bumps
1199790	1209650	and ridges and whatnot. Now if you remember, I'll show the picture again of the close-up.
1211190	1220190	When the gate of the largest wheel is under the fence, that causes a drop, right? There's less
1220190	1225250	wiggle room. That right contact point moves in, so it gets lower. The left contact point would get
1225250	1230430	higher. So that's essentially what we're looking for on the graph. We're looking for where the
1230430	1237350	right contact point drops down for maybe a number or two, and then goes back up. Because the gate
1237350	1241670	would be under the fence, and then you would go past it, and it would not be under the fence
1241670	1245990	anymore. So it would drop down and go up. So essentially, you want to look for the shape of a gate
1246630	1252650	in this reading. Now you can see there's a drop here, but it goes on for a little while before
1252650	1260770	going up, so that's probably not it. That would be really wide for a gate. But here, you can see
1260770	1268590	it drops down for a quarter of an increment for two readings, and then drops back up. The thing
1268590	1274310	about these safe locks is you don't have to be precise in dialing. That is also
1274310	1280390	why we go every two numbers. You go from 0, 2, and then 4, every line here on this graph.
1280490	1290150	So if the combination is 16, 28, 40, you can dial 17 or maybe 18, 28, 40, and it would still open.
1290710	1297340	So you want to look for the shape of the gate in the graph, and that will tell you...
1298420	1304960	The middle of that gate will tell you one of the numbers in the combination.
1308390	1314230	Now we're going to assume that the number we found is 40. So at this point, we know that
1314230	1322710	the largest wheel in the lock has a combination of 40 associated with it.
1322890	1327570	But we don't know which wheel yet. We just know that one of the wheels in the lock is larger than
1327570	1336630	the others, and the point at which the contact area goes closer together and then further apart
1336630	1345090	centers around 40. So we do something called the high load test. We put 10 numbers lower
1345880	1351820	on the first wheel, and then we put the other two wheels on the correct number. So we found...
1351820	1360540	We're pretending we found 40 as the correct number. So we will throw the first wheel off by 10, 10 numbers lower.
1361820	1368920	Now we found 40 with left rotation. So whenever we put one of the wheels on 40, it always has to be
1368920	1377060	with left rotation. So the first number, we will use right rotation to 30. We pick up the wheels,
1377060	1384400	all the wheels, so four rotations to 30 with right rotation. And then we spin left three times to 40.
1384400	1391680	So that would put the second and third wheel on 40. And we will measure the contact area here. And here
1391680	1395940	it is important to take both left and right contact points. And then what you want to do
1395940	1403480	is figure out the space between them. So if it is at 96 and 3, that is a 7 number difference.
1403480	1409620	So we would write down 7. And we would record that down. And then we do the same with the second wheel.
1409700	1417400	We put the first number on the correct number. So left to 40. Left four times to 40.
1417400	1424200	And then go right three times to 30. Putting the second wheel, throwing it off by 10 lower to the
1424200	1431640	wrong number. And then left to 40 on the third wheel. Record the space between the contact points.
1431640	1434960	How many numbers there are. And then write that down.
1436720	1444620	Now we do that again for the third wheel. Left rotation four times to 40. And right twice to 30.
1445060	1452080	That ensures that only one number is off. The other two wheels are on the correct number.
1452820	1457800	And then you can repeat with 50 as well instead of 30. So that would be the high test.
1458820	1467900	Now the test combination with the widest contact area is the one that 40 belongs to.
1468400	1473460	So for instance, we did three test combinations here for this low test.
1473640	1485300	If for this last sequence that we dialed, 40, 40, 30. If that has the contact area with the most space
1485300	1492380	between it. Now normally before we were looking for closer contact points, but here we're looking
1492380	1501400	for furthest apart. And the reason for that is because we have the correct number on the wheel,
1501400	1508820	on two of the wheels, and the wrong one on one of the wheels. So if the wrong one is on, let's say
1509700	1516640	here, let's say the third wheel has 40. So if we're intentionally putting on the wrong number,
1516640	1521200	it's going to be a wider contact point. But seeing these two, it's got the correct number,
1521200	1527840	so it'll be closer. So this allows us to figure out which wheel that 40 belongs to, simply by
1527840	1535520	putting the correct number on each wheel twice, and then having it off on one of these. So if
1536700	1543180	this wheel, if wheel three has 30, and it's wider here than the other two tests, then we can
1543180	1548700	successfully conclude that 40 belongs to the third wheel, the third number in the combination.
1549420	1555900	And then you can, you know, repeat with 50 just to really be sure that your readings are correct.
1555980	1562300	So we're going to assume that 40 here is the third number in the combination. And then yeah,
1562300	1569020	check your rotation. Anytime you dial to a correct number, you want to make sure you always
1569020	1577240	use the correct rotation. Now we found one of the numbers in the combination, and we know it's the
1577240	1584040	third wheel. So in order to find the other numbers, we essentially just repeat the same step
1584620	1591700	with this new information added in. So we run the other two wheels through every two increments,
1591700	1599420	but we have the third wheel on 40 whenever we read the contact point. So the way that this is done is
1600840	1606100	we know that the third wheel, right, the first wheel that gets picked up, that means we have to
1606100	1611840	set it last. That is with left rotation to 40. So what we want to do is we want to pick up
1611840	1619300	all the wheels with right rotation now, and then we'll say let's start at zero, and then we spin
1619300	1629100	left for one rotation. So that picks up just the third wheel, and we stop on 40. So now we have left
1629100	1635660	rotation on 40. Now going to zero isn't going to affect any of the wheels now, remember, because
1635660	1643660	we have to pick up the third wheel in order to affect the rest. So we can safely move around here
1643660	1648300	without fear of disturbing the other wheels. So we can read the contact point again.
1648420	1655300	Going from inside the contact area, we can read the right contact point and then graph it. So we
1655300	1661520	just do this graph, and at the top we can maybe just write wheel 3 left 40, just so we know
1661520	1670640	that we're doing this graph with wheel 3 on 40 with left rotation. And then what you can do now
1670640	1675360	is you turn right until you reach 40. Now that picks up the third wheel.
1677040	1684200	Go to zero where the other two wheels are resting together, and that picks up wheels 2 and
1684200	1690620	wheels 1 at the same time, because remember we had everything picked up together. We only
1690620	1696600	messed up wheel 3 in order to put it on 40 by itself. You can turn two numbers over,
1696600	1698740	spin left again one full rotation
1700840	1710540	to 40, go to the contact area, and report it down again. And we just go do that the whole way around.
1712560	1718500	So here we can repeat the same high-low exercise. So we're going to pretend we found
1719740	1726880	a drop in the graph and then a rise back up centered around 80. So we found 80 with right
1726880	1735560	rotation now. So what we're going to do here is a low test. We're going to start with wheel 2,
1735560	1741100	and we're going to throw it off by 10 onto 70. So wheel 1 we put it on the correct number,
1741100	1746180	80, with right rotation. So that means we spin right, picking up all the wheels,
1746180	1754460	stopping on 80. Then we spin left, picking up wheels 3 and 2. So we go three times to 70.
1755180	1761960	And then here's where it gets interesting. We need to go to 40 now with left rotation because
1761960	1770400	we found 40 as the correct number with left rotation for wheel 3. But if we were to continue
1770400	1780300	past 70 left into 40, it would mess up wheel 2. So there's actually a clever way to fix this. So
1780300	1787860	we spin right, picking up all the wheels, and then we stop on 80, which is what we found to be
1788420	1796900	one of the other numbers. We can spin left, one rotation, picking up wheel 3, another rotation,
1796900	1803460	picking up wheel 2, and we want to put wheel 2 with left rotation on 70. So that is 10 lower.
1804360	1809560	And then we want to go to 40 now for the third wheel. But if we were to keep going,
1809560	1816200	it would mess up wheel 2 on 70. So what we do is we can reverse directions here,
1816200	1825020	pick up wheel 3 from 70, go to 40, but remember this is not the correct rotation. We're turning
1825020	1833240	right. We need to be turning left. So we just go past it, let's say to 30, and then we can go left,
1833240	1842540	picking up at 30, setting wheel 3 on 40, at which point we take our contact point readings,
1842540	1849920	or our high-low test. And then again, you would write down the number of increments,
1849920	1857220	the space between each of the contact points. And then do that with the first wheel. We throw
1857220	1862120	the first wheel off by 10. So we go left to 70 for the first wheel, picking up all the wheels,
1862120	1869080	and then right three times to 80, and then left to 40. So we write down the numbers. Again,
1869080	1877620	we look at what is the widest contact area, and that will give us where our second number lies,
1877620	1884680	which wheel it belongs to. And usually locks will read this way. It will read third wheel first,
1884680	1890040	and then the second wheel, and then the first. But sometimes it can go other ways. But following
1890040	1895720	this method, it doesn't really matter which wheel reads first. As long as you know how to dial in
1895720	1903960	these numbers, then you can still do it just fine, no matter which wheel reads first. And then here,
1903960	1908300	we have two of the numbers in combination. So let's pretend that 80 belongs to wheel 2. So it's
1908440	1915000	a question mark for wheel 1. We know 80 is right rotation to wheel 2, and then 40 is left rotation
1915000	1922060	to wheel 3. And the last wheel, you can graph it, but generally you just brute force it. You would
1922060	1929840	just try 2, 80, 40, or 0, 80, 40, 2, 80, 40, 4, 80, 40, until it opens. When you're starting out,
1929840	1935320	it is actually a good idea to graph that last wheel as well, just in case you messed up on the
1935320	1942400	first two and you did not find the correct number. It is useful to have that extra information.
1944500	1952780	Now there's different group 2 locks. The one I am using here that I have shown is what is called
1953260	1961780	a Sargent and Greenleaf and S&G 6730. There's two major variations of 6730 and 6741.
1961780	1967320	They operate the same way, work the same, you cannot tell by looking at it which one it is.
1967320	1974140	It's just that the 6730 has slightly tighter manufacturing tolerances, which is why I
1974140	1981120	recommend going every two increments on your graph rather than every two and a half. But if you know
1981120	1987900	you have a 6741, if it is labeled a 6741, then you can get away with going every two and a half
1987900	1994180	increments because those tolerances in the manufacturing are not as tight and you will
1994180	1998180	be able to find the correct number by going every two and a half increments.
2000220	2007620	Now another popular brand is Lagarde, the Lagarde 3330. They have slightly oval wheels and
2007620	2015040	the reason for that is because of the way that inside the wheels work, there's a certain
2015040	2021200	mechanism that allows you to change the combination and that puts pressure on the wheels in certain
2021200	2028560	ways and that just makes it slightly more oval shaped, which means the wheels can essentially
2028560	2035440	mask the gates on other wheels. Maybe none of the the wheels are, you know, bigger than the others
2036060	2041340	but they can be aligned that when they're all picked up and they're all moving together, the
2041340	2048060	oval shape covers, essentially becomes the biggest part of the wheel pack in that location and that
2048060	2054700	gate is never going to be, is never going to allow the fence to drop lower because one of the other
2054700	2061720	wheels will be larger in that area. And so it can be rather difficult to work with a Lagarde 3330
2061720	2070020	so I do not recommend starting out with that. There is also a divold which is a lock with a
2070020	2075760	drive cam where instead of having one side that's more slanted, it will be a U-shape,
2075760	2082780	more uniform U-shape. And so in the case of a divold group 2, you want to take both contact
2082780	2088000	points into account since there will be less variation. You want to take both into account
2088000	2092780	and look at the left going up and the right contact point going down.
2094300	2103200	Whoops. Now some final tips is you want to be really precise in dialing. You want to
2103860	2108840	not just read it in one-eighth of an increment, but you want to dial to one-eighth of an increment.
2108840	2115240	You want to make sure you're not accidentally dialing 16 and one-eighth or 16 and one-fourth
2115240	2120980	because you're going every two increments. So maybe the combination is 15. You don't want to
2120980	2126960	go 16 and one-eighth and have it not open, but maybe on 16 you can detect it. You can detect
2126960	2131560	that it's the correct number but not 16 and one-eighth. You want to make sure you're reading
2131560	2137400	the dial from the same angle each time. So if you're looking at the safe lock, you want to
2137400	2141840	make sure you are reading from the same angle. Let's say you're reading it from this angle
2141840	2147620	this time. You don't want to look at it like this as that will change where you
2147620	2154120	think that contact point is. So you want to make sure you're really consistent, especially also
2154120	2159180	with the amount of force that you use. You want to make sure it's the lightest possible and you
2159180	2164360	want to make sure it is the same each time. So you want to be really consistent in everything you do.
2165520	2170720	You can also try it with a known combination. You can, let's say you know the combination is
2170720	2179880	20, 40, 60. Well you can test at 20, 40, and 60. You don't have to graph the entirety of the dial.
2179940	2186740	So just to be able to detect how the contact point feels when one of the gates is under
2186740	2193020	the fence and how it feels when it's not, you can graph from let's say 10 to 30 and then like
2193020	2198040	you know 10 above and 10 below each of the numbers 20, 40, and 60 so that you can tell
2198040	2206000	how the graph is supposed to look. And that is a very very useful practice to do. You can also
2206000	2210900	remove the back cover of the lock so that you know exactly what's happening and you can really
2210900	2215500	correlate what you're feeling with what is happening inside the lock. And then if all else
2215500	2222400	fails you can buy my book. Well not really, I put it online for free. So it is on Amazon but I don't
2222400	2229780	recommend it unless you really want a hard copy. There's a PDF I have uploaded at this link down
2229780	2237020	here and you can download it and basically just do whatever you want with it. I don't care.
2237940	2245080	Now on YouTube I have a video series that follows a book. It's similar to this talk but it's a lot
2245080	2253020	more in-depth. So it covers different sections that I have covered here in this talk but with
2253880	2259500	much greater detail and I also cover additional more advanced techniques in order to figure out
2259500	2265640	the combination faster and with greater precision. There's online forums such as this link at the
2265640	2272120	bottom here it points to keypicking.com and they are very welcoming to newcomers as long as you
2272120	2279380	are able to show that you are not trying to use this knowledge for criminal activities and you
2279380	2285380	are interested in this as a hobby. I mean people are very welcoming. On ebay you can buy locks on
2285380	2297060	ebay. I highly recommend sng6730 or 6741. You can also just search up sng6700 series.
2297910	2305160	And just practice. I mean practice is the best way to learn. I mean you can read and watch all
2305160	2310520	the content on safecracking and understand everything that's happening but you cannot
2310520	2316380	develop the touch for feeling the contact point. You don't develop the sight for reading the contact
2316380	2323380	point unless you actually practice. And I also just remember I forgot to mention this picture
2323380	2328720	here. So in order to read the contact points and dial it more accurately you can take a piece of
2328720	2336000	paper or maybe a needle or anything and tape it onto the dial and the dial ring just to be able
2336000	2344380	to more precisely pinpoint what is on the dial. And that is the end of this presentation.