Forensic Examination of a Forced Entry
You are called to a commercial burglary. The front door has a cylindrical lock with a deadbolt. The door shows pry marks near the lock and the frame is bent. The deadbolt is extended but the door is open. The lock cylinder is intact but the keyway is damaged. The owner reports that a large sum of cash was taken from a safe inside. The safe is a floor safe with a combination lock, and it appears to have been opened with the correct combination. The owner claims only two people know the combination: himself and his manager. The manager was on vacation. The alarm system was disarmed with a valid code. You need to determine if this was a forced entry or an inside job, and what evidence to collect.
1. What physical evidence at the door suggests the method of entry, and how does it align with the alarm being disarmed?
Read the worked answer
The pry marks near the lock and bent frame indicate a forced entry attempt. However, the deadbolt is extended, meaning the door was likely pried open while the deadbolt was engaged, causing the frame to fail. The lock cylinder is intact but the keyway is damaged, suggesting the intruder may have tried to pick or force the cylinder but failed, then resorted to prying. The fact that the alarm was disarmed with a valid code suggests that the intruder knew the code or coerced someone who did. This contradicts a random burglary. The physical evidence at the door (pry marks, bent frame) is consistent with a forced entry, but the alarm being disarmed indicates the intruder had inside knowledge. It is possible the intruder forced the door after disarming the alarm, but then why damage the lock? Perhaps the intruder wanted it to look like a break-in. Alternatively, the door may have been pried from the outside while the alarm was disarmed by someone inside. You should collect the pry marks (photograph and cast), the damaged cylinder, and any tool marks. Also, check the alarm panel for the code used and the time of disarm. Compare with the manager's whereabouts.
2. How would you examine the safe to determine if the combination was used or if it was manipulated?
Read the worked answer
The safe appears to have been opened with the correct combination because there is no sign of drilling, punching, or forcing. You should examine the dial and the bolt work for any signs of manipulation. Check the dial for scratches or marks that might indicate the use of a dialing tool or listening device. Inspect the bolt work for unusual wear or marks. Look for any evidence of a combination being obtained (e.g., written down, coerced). Since only the owner and manager knew the combination, and the manager was on vacation, the owner becomes a suspect or a victim of coercion. You should interview the owner about the combination's security and who else might have access. Also, check the safe for fingerprints or DNA on the dial and handle. Compare the time of the alarm disarm with the owner's alibi. The lack of forced entry on the safe strongly suggests an inside job or that the combination was compromised.