David Ljung Madison: I once had physical access to a Unix box that had password control on it's single-user mode, so I couldn't break in easily through a reboot. Instead I used file corruption as a tool. I kept turning the system on and off during boot until it finally corrupted the filesystem. Then when it noticed the corruption during reboot, if it can't fix it itself, it puts you into a root shell so you can fix it manually. Just fix the filesystem, mount it, echo a new entry to the password file, and reboot. If you have trouble with a system that can generally fix it's corruption automatically, you can either try to interrupt the repair process with control-c, or you can just do shutdowns during the repair to make things worse. There is a risk that you will permanently damage all or part of your filesystem if you attempt this.