He could take out the hard drive, take it to a computer shop and have the files on it copied to another hard drive.
It also depends on where she put the password. If it’s on the administrator account, not much he can do.
He can try booting and holding down the F-2 key which will give him the choice to boot up in safe mode (I’m assuming a Windows computer here) and he might be able to get into administrator mode that way.
That's what I would recommend. Before proceeding further, I would get a snapshot of the drive as it is now. That's what cops would if conducting a raid. You want to copy the data before there's any chance of accidentally modifying something (e.g., a file access date or web history or similar).
Then you can install the drive, or a copy of it, into another machine as a secondary disk. Then, as administrator on the other computer, you can browse and modify the secondary volume as you wish.
Another option is to burn a Linux boot disk or USB key. You can put that into the computer as it is now and boot into a fully functional Unix system. It will not modify the hard drive (unless you do it deliberately), but you will be able browse the hard drive, copy off files, run cracking tools, etc. One possibility is Knoppix.