1

My friend's MacBook was stolen. He was mostly using Windows with Boot Camp. macOS was not used at all.

How likely is it, that the thief may be able to reset Windows password?

Is it possible to transfer the hard disk to another computer and access it through Windows files.

And of-course, I don't want specific information about resetting password for accessing files etc. Only a confirmation what might be the worst situation.

0

If a person created a Windows 10 installer flash drive and use this flash drive to boot the Mac, then the person would have access to the Windows user files. The ISO file needed to create this flash drive is made available free of charge by Microsoft. The file can be downloaded from this Microsoft website.

For example, when booting from the October 2018 Windows 10 update, you will first get the screen shown below.

If you press the key combination shift+F10, then you will get a the Command Prompt windows shown below.

If a user account was named dma, the one could change the directory to this users Desktop by entering the command given below.

cd /d c:\users\dma\desktop

Some newer Macs will have Windows installed with a Windows Recovery Environment (WRE). However, if someone tries to use WRE to open a Command Prompt Window, then they will be prompted to select a existing user account and will be required to enter a password.

0

You didn’t provide enough detail to adequately address the actual problem (I.e MacBook model, version of Win10, was it unlocked/unencrypted, etc ), so we must look at this from the worst case scenario:

Once a device is physically in the possession of nefarious parties, you must assume the entire system is compromised. Guessing what the risk is at this point is an exercise in wishful thinking.

This is where you advise your friend to start securing accounts (change passwords, add two factor authentication, etc.)

  • "enough detail" Like what? – Roger Wayne May 1 at 17:46
  • Like MacBook model. Some came with 2.5” drives, some with mSATA SSD and finally PCIe SSDs. Was it unlocked/unencrypted when stolen? What version of Windows – Allan May 1 at 17:53
  • A knowledgeable thief will know to wipe the system and install fresh, easy to do without a password protected startup. Oddly enough many stolen laptops this never happens to, if the thief can get into it (however) they may continue to use it as is. So yes change all passwords that might be on that Mac. all of them – Steve Chambers May 1 at 17:57
  • Windows user account has password but are the Windows-files accessible via another computer if the hard disk is connected directly to another computer? – Roger Wayne May 1 at 18:15
0

If the Mac is booted into Windows, you lose all the benefits of macOS like Find my Mac. Unless you've set a firmware password, presume the thief has access to absolutely everything on that system since it's now effectively a Windows PC.

My strong suggestion is that it's better to run Windows under Parallels than to use Boot Camp and thereby give up so many macOS-related protections. FileVault, for example, is effectively useless on a Boot Camp-enabled machine.

A T2-equipped Mac with FileVault enabled and ONLY macOS installed (no Boot Camp) is practically impenetrable, especially if a secure firmware password has also been set.

0

It depends on the specifics of the Windows setup. If your friend had the Mac setup with "Device Encryption" (known as BitLocker and/or Full Disk Encryption in earlier versions of Windows) - then the data is reasonable secure as long as your friend had a hard-to-guess passphrase for unlocking the encryption.

If your friend did not encrypt the Mac, then all bets are really of. You can assume that the thief has relatively easy access to all files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .