How do I obtain the FileVault2 recovery key after it has been modified? The Mac is encrypted using filevault. If the user changes the recovery key using 'changerecovery' command, is there any event generated? And is it possible to get the new recovery key?
In theory, you might be able to use the MDM hooks which are not publicly documented by Apple. In practice, it's easier to place an institutional key on devices so that you can manage things and not hope to receive updates to any personal keys.

See: https://jamfnation.jamfsoftware.com/article.html?id=314

One MDM provider's framework is covered at http://resources.jamfsoftware.com/archive/Administering-FileVault-2-on-OS-X-Mavericks-with-the-Casper-Suite-v9.2.pdf