I have a MacBook (Retina, Mid 2012 if it's relevant) which I installed Mountain Lion onto, creating one user account only (an Admin account). There is a Guest User, marked for "Sharing Only". The hard drive was encrypted with FileVault 2 at the time of install, and the recovery key stored away.
For various reasons the password to my user account was disclosed (but NOT the FileVault recovery key). I changed the password on my user account before it could be used, but the old password is still known.
Is the old password still retained with respect to the FileVault partition, and might enable someone to decrypt the FileVault-encrypted drive? Put another way, are my new password and the recovery key the only way to decrypt the FileVault partition?
Best Answer
Once you change the password, it has been charged and the old password can not access the FileVault decryption protocol. It would be nightmarish if you had to always remember any and all passwords ever used by the FileVault account(s).
If you want really great info to FileVault please watch: http://docs.macsysadmin.se/2013/video/Day2Session5.mp4