Indeed, note I said "easier" and pointed one of the easier ways enabled by lack of OS partition encryption. I'll go even farther than parent: If your adversary

Indeed, note I said "easier" and pointed one of the easier ways enabled by lack of OS partition encryption. I'll go even farther than parent: If your adversary is determined enough, you should assume that any physical access to your machine, for however short a period, means you should never ever use it again - and that you have no practical way to know if said access has indeed compromised your machine. See e.g., Thunderstrike. corollary: You can never be sure that your machine, which has passed through 10 different hands (factory, tester, packages, store, courier, ...) is not trojaned to begin with.