Forensics of Covert Entry

The talk, given by two members of the Physical Security Village, opens with why someone might investigate covert entry. A facility may keep getting entered with no obvious cause, or a case may hinge on whether a lock was tampered with. The speakers stress that physical marks turn a suspicion into evidence, and that anyone with a legal stake should bring in a qualified expert rather than rely on their own observations.

The core method is comparison against a baseline. Normal key use wears a lock along one straight path, while picking, raking, impressioning, and over-tensioning leave scratches at odd angles, disturbed edges, and fresh polish. Corrosion on brass can even hint at how long ago a lock was worked on. Because pin finishes and wear patterns vary, the speakers recommend testing identical exemplar hardware, aged or bypassed with known techniques, before drawing conclusions. They then walk through latch and deadbolt bypasses with wire, J-tools, and card pushes, plus electronic traces such as jumpered intercom terminals, access control and elevator logs, and tamper sensors that are often never wired up.

For practitioners, the lessons are procedural. Keep a dated, bound notebook with corrections left legible, maintain chain of custody, and pull a suspect lock from service quickly so others cannot alter it. Avoid destructive steps such as disassembly before documenting the pin surfaces. Observe how a space normally operates so you can recognize abnormal wear. The talk closes by noting that many entries leave no trace at all, so proper installation and secure hardware remain the strongest defense.