Recovering the combination on a Sentry s0207 fire safe
Channel: Patrick Niemeyer
Date: 2012-05-19

Other Sentry safes probably work similarly.  I lost the combination to this safe a long time ago but it was unlocked.  Getting the combination from one of these safes when it's in this state is very simple.  I hope this video is helpful for some other people.

Someone asked "what if it's locked?" and I wrote up the following:
if it's closed then you're really asking "how can I pick the lock on this safe?" and it's a substantially harder problem.  Any videos on youtube about lockpicking a combination lock should get you on your way, but here's some stuff about this safe:

From outside the safe, you'll see that the numbers in the combination go from ~0-99 (or so).  This means that to try to pick the lock by brute force, you'd need to try 00-00-00 through 99-99-99 until you find the combination - that's a million combinations!  WOW!! Sentry made a pretty hard to pick safe!!

Well, if you look in the video at ~3:34 in the video, you can see that, like all 3-number combination locks, this has a series of three discs with a notch in each disc (and when unlocked, the unlocking pin slides into that notch).  The final disc is "gear" shaped and it actually only has 24 unique spots that are either a peak or a valley.  This means that if the right combination is 12-23-34, the safe would probably "allow" 11-22-33 (all numbers off by one) or 13-25-35 (off by one the other way), etc.  In other words, you might be able to really think of the front of the safe as having numbers 1-24 for each section.  That's a huge reduction in the number of combinations to try.  It was 100*100*100 = 1 million possible combinations, now it's 24*24*24 = 13,874 combinations, that eliminated ~98% of the combinations you'd need to try (I'm ignoring some details here). Furthermore, the last number in the combination has to be one of the "valleys" and you can tell where the valleys are on a locked safe, so the possible combinations for a brute force attempt are really 24*24*12 = 6,912.

It's challenging to pick a lock like this, though, because that third disc is shaped like a "gear".  If it were a smooth, round disc, then you could definitely pin down one of the numbers by doing the following:
1) put a little pressure on the unlocking pin (not much)
2) this will create a little friction between the three spinning discs and the unlocking pin
3) slowly turn the dial from the outside, maintaining the pressure on the unlocking pin
4) at some point, you'll feel a little "slip" in the pin.

Because the three discs won't be manufactured exactly identical to one another, one will rub "the most" against the unlocking pin.  When you feel that slip, you've identified one of the numbers in the combination (you now have that disc with the most friction against the unlocking pin in the proper orientation for the safe to unlock).  However, because that final disc is shaped like a gear, if you try to do what I just said, you'll find the unlocking pin slips into one of the gear "pits" with each 1/24's rotation and it's usually nearly impossible to tell "am I in a dip because it's a normal 'valley' in the gear, or am I in the 'dip' for the actual unlocking spot?"

You definitely *can* use that information, though, to rule out a bunch of numbers for the final spot in the combination.  The final number in the combination will be where one of the 12 "valleys" for the gear are.  Good luck!