> You should be able to image her hard disk, and probably boot it up in a VM. Is that still an option? I haven't used Windows for a long time, but I believe Mi

> You should be able to image her hard disk, and probably boot it up in a VM. Is that still an option? I haven't used Windows for a long time, but I believe Microsoft has been pushing towards enabling BitLocker by default for everyone. If you don't have the BitLocker recovery key, or access to the user's Microsoft cloud account (which AFAIK has a copy of the BitLocker recovery key), the only way to decrypt the hard disk is to boot the system the normal way (with SecureBoot enabled even), since the key is held on the TPM.