...scandalously easy, following simple instructions available on teh interwebs. You do need install media. I was able to use an old free beta copy from coupla years ago that I happened to burn to dvd (luckily the user did not encrypt, or use windows live).

At the end of the day, if your hardware is compromised then you have to consider the accounts just a matter of time. So long as an attacker can get to the hard drive they're going to be able to get in.

Which is why we should all be using BitLocker nowadays.

If you've got physical access to the machine then passwords aren't going to do shit on any OS. This (the second approach) is not dissimilar from setting init=bash on Linux (or similar on other Unices).

If I actually had sensitive data, I wouldn't trust a proprietary encryption tool like Bitlocker for a second, though.

Why bother getting physical when you can just go direct to Microsoft's servers?

> ONE OF THE EXCELLENT FEATURES of new Windows devices is that disk encryption
> is built-in and turned on by default, protecting your data in case your device is lost
> or stolen. But what is less well-known is that, if you are like most users and login to
> Windows 10 using your Microsoft account, your computer automatically uploaded a
> copy of your recovery key to Microsoft’s servers, probably without your knowledge
> and without an option to opt out.

Source: https://theintercept.com/2015/12/28/recently-bought-a-windows-computer-microsoft-probably-has-your-encryption-key/

Of course, what's not so excellent a feature is what this means for recovering data from an encrypted disk that a user may have had no need to be encrypted.

If all you want to do is recover unencrypted data then yeah, boot from a linux dvd/usb. In this case I needed to recover the user's account access by resetting his password.

Can't boot from USB after making a bootable disk. what is the problem?