The easiest way to bypass the administrator password is to remove the drive and attach it to another machine or a forensic station, then use MacForensicsLab to image the drive. That being said if you need to for some reason keep the drive inside the machine, you can reset the system administrator password using the Mac OS X installation CD/DVD.
An easy way to reset passwords inside Mac OS X 10.1-10.3 is to boot from the original OS install CD and select Reset Password from the File Menu. In Mac OS X 10.4 and later, select Password Reset from the Utilities menu after booting from the installer CD/DVD. Doing this will destroy the forensic integrity of the suspect drive so make sure you do this on a copy of the suspect drive.
