FileVault: Keys, Recovery Keys and the Real Boundary
FileVault encrypts the whole volume with a volume key that is itself protected by your password and the Secure Enclave (or T2).
Two escape hatches
Either the user password or the recovery key can unwrap the volume key. In managed environments the recovery key is often escrowed in MDM — that is the first place to look.
When it is unrecoverable
If both the password and the recovery key are lost, the volume key cannot be reconstructed. Board-level repair does not help: the data on the SSD is ciphertext by design.
FAQ
Can a lab brute-force FileVault?
No. The key derivation and Secure Enclave rate limiting make that impractical.
Does Time Machine help?
Yes, if the backup is not itself encrypted with a lost key.