Yup. it's exactly this. After first unlock, data is decrypted and loaded into me...

wickedsight on Oct 28, 2022 | parent | context | favorite | on: Apple security bounty upgraded

Yup. it's exactly this. After first unlock, data is decrypted and loaded into memory. You shouldn't be able to extract it though, without unlocking the device.