I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks.
I've also learned that the numeric password (aka. "recovery key") is just one kind of key protector so that it can be deleted and thus invalidated.
I observed that with an exported key package, even if the corresponding key protector has been deleted, repair-bde can still complete the decryption process.
However, what exactly does this key package contain? Does it contain the (encrypted) FVEK?
I think FVEK is the actual thing which worths backup, because I think there might be cases that key protectors and/or VMK got deleted/corrupted/sabotaged. Therefore only the FVEK as the "one true key" can salvage the data in that case.
