Which of the following can most forensics tools crack on an iOS device?

Most advanced mobile forensic tools can successfully crack simple passcodes (e.g., 4 or 6-digit numeric codes) on supported iOS devices. This is achieved through brute-force methods that are often accelerated by leveraging hardware-level exploits, such as checkm8, which can bypass the security mechanisms of the Secure Enclave that would normally introduce delays after failed attempts. The relatively small keyspace of a simple passcode makes this a computationally feasible attack vector for forensic investigators to gain access to encrypted user data.

A. Touch (fingerprint) ID: Forensic tools do not "crack" biometric data. The raw fingerprint data is encrypted and stored within the Secure Enclave and is not accessible. Tools may bypass biometrics, but they do not break the underlying biometric template.
C. Passphrase: Complex alphanumeric passphrases have an exponentially larger keyspace than simple passcodes. Brute-forcing them is computationally infeasible against the hardware-enforced security measures of modern iOS devices, making it an impractical attack for most forensic tools.

1. Mahalik, H., DePew, C., & Leclair, C. (2019). iOS Forensics for an A12 Device: The story of a forgotten passcode and a locked device. DFRWS USA 2019. This paper discusses the state of iOS forensics, noting that for locked devices, "the only way to get access to the data is to determine the passcode" (Section 3.1) and highlights the feasibility difference between simple passcodes and complex passphrases. Available via The Association of Digital Forensics, Security and Law.

2. National Institute of Standards and Technology (NIST). (2014). Special Publication 800-101 Revision 1: Guidelines on Mobile Device Forensics. In Section 4.4.2, "Passcode Recovery," the document discusses techniques for bypassing or recovering passcodes, noting that brute-force attacks are a primary method, the success of which is highly dependent on the code's complexity (simple vs. complex).

3. Zdziarski, J. (2017). iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets. In Chapter 5, "iPhone Security and Data Encryption," the author explains how the device's UID key is combined with the user's passcode to derive the encryption key. The text clarifies that the strength of this protection is directly tied to the complexity of the passcode, making simple codes the primary target for brute-force attacks. (Published by O'Reilly Media, often used as university courseware reference).