Even then, if it's an OS password (drive encryption n/inc) and they have physical access to the disks containing assets then it's already game over.