I use Check Point Full Disk Encryption, but hope that this question can be answered generally. Is it possible for me to get, or extract, my own 256-bit AES key? By the way, I don't use any special password for the decryption itself, so this key must be based on my Windows login password alone (which you can assume is long enough to prevent cracking).
(Why? It would be nice to write the key down in case some problem comes up. I understand that the key can be pushed into "the cloud" and I could contact someone at the company if some problem ever came up, but there's some peace of mind in having it written down in my home. And, I understand that this allows a thief to steal that note and my hard disk, thereby getting all of its information, but I don't want to start this philosophical discussion here.)
As I see it, Check Point could reveal the key within its pull-down menus if it wanted to but probably chooses not to. Further, I would guess that the Windows 7 DPAPI prevents any other software from extracting the key even after I've logged in (and thereby given that software full permission to do anything, including physical access and decrypted access of the hard drive).
My goal here is really to confirm both sentences in the above paragraph. More generally, I'm curious about whether DPAPI, using the login password alone, can truly prevent any mischievous application (with full permissions and physical hard disk access) from determining the protected data of any other application...but I guess that probably was Microsoft's design goal.