Unlocking a Gary TL-15 Round-Door Safe (2009)

I once bought a vacation home that was a century-old English cottage that went through 7 different owners over time. It once belonged to a US state senator. Another time it belonged to a prominent local businessman who went to jail for white collar crime, and went through a nasty divorce. Anyway, the house had a TL-15 Star Safe embedded in the wall in the master bedroom. The previous owner did not know the combination. Neither did the owner before him. Some unknown person at some point had attempted to open it, as the safe had 3 drill holes on the face plate.

There was a very old sticker on the safe bearing the name of the company who apparently installed it. The phone number was so old it did not have an area code. Fortunately the company still existed after multiple decades. I called them and asked if they could open it in a non-destructive way. One of their technicians came, looked at it and probed it for a couple hours, but determined he could not open it. And the combination had been changed from the manufacturer's default. He gave me the contact info for a reputed safe technician who could help.

Later I called this safe technician, but he was incredibly difficult to get a hold of. I had to leave multiple voicemails and send multiple emails. We chatted briefly one time and he said he would get back to me later to schedule an appointment. But he seemed half-retired and not interested in the job, as I never heard back, despite multiple contact attempts and my offer to pay handsomely. Eventually I became frustrated with his non-responsiveness and stopped caring about the safe.

Fast forward a few years later, I was going to sell the vacation home, but I really wanted to open the safe before selling. Curiosity had gotten to me. I searched online for another safe technician, and found a supposedly reliable guy. I arranged an appointment. He showed up a few days later. I asked him to open it any way he could, even if he had to destroy the safe. He started drilling, making multiple holes over the course of 2 hours. Eventually he came to me and said he ran out of drill bits as they all got worn out. He had to leave and promised he would be back.

It took one week for him to eventually come back early one morning with more drill bits. He spent another couple hours drilling. Then he put a camera scope in the holes and claimed he could see 3 of the 5 wheels spin while the other 2 were broken. He spent an entire day trying to manipulate the wheels. But after a whole day of work, he came to me with a defeated look and apologized saying he was sorry but he doesn't think he is able to open the safe.

I went back online to find yet another professional who could help. I learned that what I really needed to look for is a professional who is a member of SAVTA (Safe & Vault Technicians Association). So I found a SAVTA tech who on the phone told me a TL-15 safe in a residence is unusual as it is normally made for businesses like a jewelry store. Unfortunately he said his next availability would be about a month from now, and I was going to sell the house in the coming weeks.

Eventually I found another SAVTA tech who was available on a short notice. He and a colleague both arrived a morning, and it took them 3 hours to do more drilling and more manipulation to FINALLY open the safe.

Guess what was in it?

Nothing. It was empty! I closed the sale of the house literally 2 weeks later. I was still very relieved to have gone through this hassle to open it. The unsatisfied curiosity if it had not been open would have eaten me alive :) Also I decided in my next house I wanted a safe rated TL-15, as clearly they can withstand a lot.

In 1999 we bought a house. It had a locked safe embedded in a wall and the seller did not know the combination - the house had belonged to his parents who had passed away. When we started remodeling the house we used a jackhammer to pry the safe from the wall, planning to discard it. But, in a moment of inspiration, I loaded the safe on a pickup truck and took it to a local locksmith to see if he could open it. The locksmith took a walk around the safe and reported "the combination is xxL,yyR,zzL." I was astonished. Until he showed me the secret: there was a piece of paper taped to the back of the safe.

Incidentally, if you don't know this, the DoD and US Government standard for turning in a safe no longer in use is to set the combination to 10-20-30-40. That's always worth a try on any safe that isn't in use.

Few years back the electronic lock on a safe in our office somehow died. The locksmith who supplied it was on vacation, but we somehow were able to convince him to give us the drill plan with the assurance that he will be the one to fix the safe after we had opened it ourselves. It was not that much of the drill-plan, but “take an angle grinder, cut there and the internal part of the lock should just fall inside the safe, 15min of cutting tops”, well it took most of the day and we busted entirely new DeWalt angle grinder in the process. Well, the procedure he gave us was for the lower security model, so instead of cutting through the bracket that held the lock in place, we were cutting through the actual locking bolt. Still, it was kind of a fun experience.

These "sergeant greenleaf" locksets are old but common in military/national security use around the world, although military models have a couple extra security features not sold to the public. They are amazing devices. They are 99.9999999% reliable for decades without any maintenance but nevertheless can take a beating. The combination can be changed in seconds. Recovering a forgotten combo is possible with only a screwdriver, so long as the safe is still open. Most are or have been replaced by digital locks, but I've always liked Sergeant Greenleaf.

I just posted this amateur documentary about a guy that prides himself in saving safes from the drill. He only does manipulation. He uses a stethoscope and sometimes a laser pointer to visualize the wheel angles.

https://www.youtube.com/watch?v=1hz_kjTc8DQ

They have machines that try every combination. (For example: https://blog.enbewe.de/2023/01/26/opening-a-safe-the-diy-way... )

If you know how many digits and the Left-Right pattern, wouldn’t this be the best way to do this, assuming you have a week to run it?

If you're trying to find Figure 2, click on Figure 1 (the photo) and use the right-arrow nav to advance to the 2nd photo.

Even if I'm not familiar with a topic there's something deeply satisfying about reading (watching, listening to) accounts of people who are good at their jobs doing intricate or technical work.

Has anyone come across safe autodialers that don't just make use of bruteforce?

Regarding electronic safe locks, I found the following videos really fascinating

* https://www.youtube.com/watch?v=lXFpCV646E0 - Side channel attacks on high security electronic safe locks

* https://www.youtube.com/watch?v=viU8Qs1Sccg - No Mas How Side Channel Flaw Opens ATM Pharmacies and Gov to Attack

I have not one but two safes I've inherited which I ought to get opened. My thinking is that both safes would not be empty, as you can store as much emptiness as you like in a single safe.

I should figure out where to begin, do I bring the safes to the locksmiths, how are the safes disposed of, et al? It should be interesting.

I was surprised to read that they filled their hole with old carbide drill bit tips and J-B Weld (a two-part epoxy). I was expecting it to be welded closed.

That style of writing. It really goes down easy.

The Lock-Picking Lawyer shows the modern way to do this.[1] Yes, there is an app for that.

[1] https://www.youtube.com/watch?v=vkk-2QEUvuk

I don't think I've ever encountered such an over-monetized site. Every square mm of space has an ad. Then pop ups will spontaneously cover existing ads. I can't even find the content.