> They are happy to let it churn for months / years (because the case is working through the system).

Is that the case? I would be surprised. I would assume success ratio does not change much by checking say 10^4 more combinations (it's either a simple combination of these strings and common prefxies/suffixes or if it's complex then the amount of combinations grows so fast that you are unlikely to get a hit)

No. Resources are always limited. Forensic investigators will not be running things on server farms for years. People who think such things really do not understand how many cases are "in the system" at any one time. Even for something relatively serious like CP, drug smuggling or lower-end terrorism, there are literally thousands of cases in-the-system. The server farms infrastructure (ie hiring cloud capacity) would be reserved for national security, foreign intelligence and stopping Magneto. The contents of your laptop are not worthy of such treatment.

Not sure how it's done in the US but an effort to crack it lile this would happen only on very high profile cases in France which is not the case of this one.

I'm betting on the second option, he reused the same password somewhere else or they just got lucky ans seized the computer already unlocked

Here's how it actually works: when the gov wants to crack your password, like really wants to, and you haven't already saved the pass in system-operated password "vaults" (those can automatically be acquired), they go to Apple or Google and say "record this users keypresses on all devices, and send us their screen activity " and, in short order, all your passwords are known.

Don't think this is the case?

Prove me wrong. Show me in their source code of the OS you're running that they don't do this.

The absence of auditability is evidence for tyranny. Auditability in the case of software is open source software and open source hardware, up and down the entire stack of the device in use. Anything short of that, and you're pwned without even being able to know or prove it -- when it comes to government.

Ahh yes the classic "prove a negative".

>Prove me wrong. Show me in their source code of the OS you're running that they don't do this.

https://github.com/torvalds/linux

https://gitlab.gnome.org/World/Phosh/phosh/

These days, most consumer and commercial machines are running multiple operating systems under Linux below ring 0. Same goes for hardware components with full access to memory and CPU time running their own OSes. Linux is mostly to completely unaware of their existence and can't do much if anything about them.

Do you have any legal cases where this occurred?

While it is technologically possible, I have never heard of a case of this actually happening.

...on LUKS? Are you sure Apple and Google had this guy's local encryption password on hand? Unless of course he reused his password (highly likely), which is the actual flaw in his security