logging into his laptop directly, while extremely convenient, is just asking for evidence distruction!! you could squish SO MUCH -- the real password (should you choose to crack it later and find that it's something like "ihatemylife"), his browsing history, atime on files, etc. you've only got one copy... instead, why not just mirror the hd somewhere first and mess with that? if you've got a Unix-like OS, just (dd if=/dev/[hd] of=~/localfile && losetup /dev/loop0 ~/localfile) as root and then poke around all you want. (you could use Qemu to run the disk-file as a virtual machine.)