If a spy enters a company , it ' s much quicker and easier for him to enter recovery mode than for example open the computer case and pull out the HDD . Thus , we may still want to apply restrictions to recovery mode . Not really . You just tell the secretary you are the repair dude or the like . You are also discounting just how fast some one can have the a machine opened up . Also if they are already there , they most likely already got past the guards and unless they look out of place , the guard won ' t notice a single thing as that ain ' t their thing . Disabling recovery mode does little except stop the vaguely curious and or stupid because of that . What you need is encryption . You encrypt most of it , only not encrypting the bits required to both and have it search for a key on a USB key fob or require one to be entered via keyboard .