What is accessible to an attacker who has reset my administrator password? I understand that it is possible to reset the administrator password on a Mac, allowing someone with physical access to a machine to create a new password that gives them access to all files unlocked files remaining on the machine after the reset process.

But what else do they have access to? Specifically:


Are all user accounts still present? 
Are all keychains still present, or are they reset or cleared as part of the password creation process?
If the keychains are still present, does the (new) administrator have access to the contents of existing keychains.
Are any files (other than keychains) erased or reset as part of the process?


I assume that FileVault protects against using this technique in an attack; would a firmware password confer any protection?
If someone has your administrator account, everything on the machine is accessible to them. People in IT Security circles say "Physical access = Total access".

Keychains can only be unlocked with the keychain password.  If an account password is changed/updated without being logged into the account AND having the relevant keychain unlocked, the keychain password doesn't change.

Meaning, someone could get access to your account perhaps, but not your keychain, without the original password.  The account and keychain passwords fall out of sync with one another.

FileVault protection similarly, will remain in place until unlocked using the correct password.  I don't believe having root access on the machine allows you to unlock the keychain or the file vault account without the relevant passwords.. that's the whole point.

Of course, theoretically a hacker with godlike skills, patience, and knowledge could manually edit the relevant passwd files to be whatever he/she wanted it to be (if they had root access), but the probabilities of this happening is somewhere between zero and nil.