That makes it impossible for you to recover the bitcoins he bought. I guess that he didn't decide to use an exchange to store his coins. Software wallets usually encrypt the file which contains the private key. It is needed to spend coins, so without the password you won't be able to do anything either. Since Bitcoin is decentralized, there is no authority which could hand you over the access of the bitcoins even if you confirmed your identity.

The only possibility is that he had left his seed (12 or 24 words used for wallet recovery) or a paper wallet with QR codes.