The machine id of the phone appears to be already known: https://www.eff.org/deeplinks/2016/02/technical-perspective-apple-iphone-case https://www.eff.org/deep

The machine id of the phone appears to be already known: https://www.eff.org/deeplinks/2016/02/technical-perspective-apple-iphone-case https://www.eff.org/deeplinks/2016/02/technical-perspective-... > From a technical standpoint, it would be possible to craft the cracking software to only run on Farook's phone by checking its hardware ID. The court order was actually quite specific that this is all that is being requested. Note that the court's order presupposes that the hardware ID is already available through some means. The court's order was crafted after a period of inquiry regarding actually technically feasible work. It's not certain how the machine id of a particular phone is known without being able to query it, but the case assumes it is known. The keyphrase is combined with the machine id and a hash is generated and compared against the stored hash to allow access. The stored password hash is stored on the flash drive and is readable since it's ordinary flash memory that can be directly read if one has physical access. So the hash and the machine id are available, and it is likely Apple uses a known and vetted secure hashing algorithm rather than roll their own. From this, one can do a brute force search using external computers to determine what the keyphrase is.