If someone has physical access to a machine, the root password is no longer a protection. Among things that can be done (from simpler to harder):
- interrupt a boot sequence. Some systems directly open a shell with root account without asking for password in order to allow the operator to try to recover manually after a major disaster (lost of password file, /bin/bash, network...)
- boot the machine from a removable media (DVD or USB stick) containing a system compatible with the disk, then mount the disk (read only if you do not want to leave traces and have nothing to change).
- remove the disk from the machine and mount it on another system having drivers for it.
Any of this methods allow to change the password file for example by adding a new admin account (UID=0 on Unix-Linux)
As said by @DKNUCKLES in comment, any of the above method can be used on a physical server but they suppose a reboot. If you have only a VM, any of them can be used with a backup (or a snapshot) of the VM, which cannot be detected at all from the running VM.