The OS might have protections in place - modern CPUs support encrypted memory - or even just something as annoying as a login prompt it won't let you past. Any

The OS might have protections in place - modern CPUs support encrypted memory - or even just something as annoying as a login prompt it won't let you past. Any attack to find keys in memory - unless you find a simple exploit for the login prompt - will be more complex than just booting the machine with that sniffer plugged in.