Question: A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the tech support company occasionally doing work for them has done nothing to safeguard against future theft. I proposed installing anti-theft software (such as Prey) and later considered establishing one system as an information-gathering honeypot with hidden keyloggers sending information to a number of email addresses. 

All physical security best practices aside, what other measures could possibly be implemented here? These are all Windows systems. I don't doubt the separate incidents are linked and being carried out by connected if not the same criminals. 

The firm has already been in contact with the local authorities. However due to a lack of documentation on the stolen items, there are no serial numbers or additional helpful information on the missing devices besides make and model, so recovery seems a dead end but at the least they're aware of the incidents.

Answer: 
Consider getting a software product which fully encrypts your hard drives. Such a software will prompt the user to enter the password used to encrypt the hard drive during boot. Without the correct password, the hard drive (including both the OS and any data) can not be decrypted, the system won't boot and the user won't get any access to the data.

In that case a thief might still be able to sell the hardware by nuking the disks, but won't have access to any sensitive information stored on it.

The default solution for Windows is [Microsoft BitLocker](http://windows.microsoft.com/en-us/windows/protect-files-bitlocker-drive-encryption), which is already available out-of-the-box in some editions of Windows. There are also other products on the market like Sophos Safeguard or Truecrypt. For recommendations which product to use, consult [Software Recommendations Stackexchange](https://softwarerecs.stackexchange.com).
If the laptops don't need to be used offline, store no data on the laptops. Use the laptops as [thin clients](https://en.wikipedia.org/wiki/Thin_client). This can then allow you to require multi-factor authentication, set up access hours, and many other additional improvements over storing the data locally.