I suppose he could have tried remounting the device read-only, and then using dd to directly update the inode table to change ownership, but, if he was already

I suppose he could have tried remounting the device read-only, and then using dd to directly update the inode table to change ownership, but, if he was already root, he could have just chown'ed it again.