content: This. If someone had physical access to the machine, it's probably not passwords they're interested in.  It's documents, web histories, or other such items.  Grabbing passwords for a box with unlocked physical access is stupid, unless you're specifically trying to elevate to Admin access.  Even that's a piece of cake, because Admins, more often than not, aren't performing the same security practices they preach about to others.