Toshiba Laptop

What password did he change? Is the hard drive encrypted? Drive password?

I would first remove the drive then connect it to a write-blocker and check for a file structure.

Sounds like a BIOS password. Have you tried to remove the CMOS battery and leave it out to reset BIOS & CMOS?

Depending on you investigative needs you would probably want to write-block and image the drive, or explore the drive via another external adapter that can take a 2.5" laptop hard drive to USB.

If it is a BIOS HDD password, it will not reset if the battery is removed.

But, I presume the vendor, Toshiba will give you a generic password to get to it if you can provide some asset tag or serial numbers.

This is the case with Dell laptops for sure. I had several machines with HDD passwords where a call to the vendor allowed to get them unlocked.

"If it is a BIOS HDD password, it will not reset if the battery is removed."

Very true - IBM's also have some security mechanisms that can be retained from battery removal.

Might want to give THIS a read. The part about KeyDisk might help.

ok gave the battery thing a go did not work roll
i can"t get the prompt up it goes straight to password so what now
do you know where i can get plans for the motherboard?

Why do you absolutely insist on starting the system ? Why don't you just take the HDD out and examine it through a write blocker / USB bridge ?

this is true i can and i have had a look at the hdd
but my client still doesn't have a lap top that works as the bios
still has a password on start up

ok gave the battery thing a go did not work roll
i can"t get the prompt up it goes straight to password so what now
do you know where i can get plans for the motherboard?

You happen to have a pic of the screen?