ALOA CPL cheat sheet

Keying hierarchy flows from the master key (top) down through grand masters, masters, and change keys; any key cuts a lock it is not bitted for only if the bitting matches at every pin position.

A 2-level system uses master and change keys; a 3-level system adds grand master, requiring at least 3 shear lines and 3 distinct bittings per chamber.

Total available key combinations for a pin tumbler = product of the number of usable cuts in each chamber; subtract master-keyed positions to find usable change keys.

MAC (maximum adjacent cut) rules limit how far adjacent cuts may differ (commonly 3-7 depending on manufacturer) to prevent key binding and ghost keys.

Progression order (e.g., 0-1-2-3 vs 0-2-4-6) determines the number of change keys available under a given master bitting; tighter progression yields more keys.

Cross-keying or keyed-alike sets share one bitting across multiple locks; keyed-different gives each lock a unique change key.

A master keyed system's security is limited by the lowest shear line: a change key will not operate the master lock, but the master operates all change locks.

Pin stack height = bottom pin + master pin (if present) + top pin; all stacks must total the same distance to the shear line for each key level.

Record key bittings and pinning charts by lock and door; a lost pinning chart requires decoding the lock by impressioning or disassembly.

Vehicle key/lock systems fall into three categories: mechanical only, mechanical + transponder (immobilizer), and smart key (passive push-to-start).

A transponder key contains a passive RFID chip energized by the vehicle's antenna coil; the chip ID must be programmed to the immobilizer for the engine to start.

Transponder cloning copies an existing chip ID to a blank; adding a new key (not cloning) usually requires a programmer and, on many vehicles, a security credential (PIN, NASTF, or online token).

Smart keys use challenge-response rolling codes over LF (typically 125 kHz) and RF (315/433/868 MHz); each fob has a unique ID and secret.

High-security automotive keyways (e.g., sidewinder, laser-cut, dimple) require code cutting or impressioning; wafer and pin tumbler designs differ in decoding method.

Vehicle door lock decoding can be done by disassembly, scope/optical reading, or progression; ignition and door often share bittings but not always.

Immobilizer systems may lock out after repeated failed programming attempts; a timed wait or battery disconnect may be required to reset.

All-keys-lost procedures vary by make: some require seed-and-key calculation, some require OBD programming with a PIN, some require removing the module.

Key code databases are organized by make, year, and code series; verify the code series against the vehicle before cutting to avoid wrong bittings.

Chain of custody documents every transfer of evidence: who handled it, when, where, and for what purpose; a break in the chain weakens admissibility.

Evidence categories include testimonial, documentary, physical, and demonstrative; locksmith investigations commonly deal with physical (tool marks, keys, lock parts) and documentary (records, logs).

Tool mark examination compares class characteristics (manufacturing pattern) and individual characteristics (unique wear, nicks, striations) between a tool and a mark.

Forensic locksmithing distinguishes forced entry (tool marks, deformation, bent bolts) from surreptitious entry (picking, impressioning, key use) and from bypass.

Photograph evidence before moving it; include scale, orientation, and overall/medium/close-up shots for documentation.

Preserve latent prints and DNA on keys, cylinders, and tools; handle by edges, package in paper (not plastic) for porous items, and avoid contamination.

A lock's condition (locked, unlocked, damaged, rekeyed) at time of examination should be documented before disassembly.

Report writing should separate observation (what was seen/measured) from opinion (what it means); conclusions must be supported by the documented findings.

Timeline reconstruction uses access logs, key control records, and alarm events to establish who could have accessed the lock and when.

Safe ratings (e.g., TL-15, TL-30, TRTL-30) describe tested resistance: TL = tool attack, TR = torch and tool, TX = torch and explosives; the number is minutes of resistance.

A combination lock's dial has numbered graduations; the drive cam, wheels, and fence interact so that the fence drops into the wheel gates only when all wheels align at the correct numbers.

Standard 3-wheel combination manipulation uses the contact points (left and right) of the dial to identify wheel positions; the difference between contact points reveals wheel width and gate location.

Changing a combination requires the existing combination (or drilling and repair); the change key or reset procedure varies by lock make (e.g., S&G, LaGard).

Relocker devices (glass, spring, or thermal) fire if the lock is attacked, permanently blocking the bolt to prevent opening.

A safe's boltwork engages the door into the body; a failed lock or relocker may require drilling at a manufacturer-specified point, then repair with a plug.

Fire ratings (e.g., 350°F/1 hour, 125°F media) indicate internal temperature limits for contents; media safes protect data, not just documents.

Vault construction includes reinforced concrete, steel liner, and door; the door's locking bolts and hinge side determine attack resistance.

Manipulation resistance depends on wheel tolerances and the number of wheels; more wheels and tighter tolerances increase the number of possible combinations and difficulty.