I don't understand how any the cracking tools work on any of the modern handsets. Are they extracting the key (DEK) from memory? Have they exploited a vulnerabi

I don't understand how any the cracking tools work on any of the modern handsets. Are they extracting the key (DEK) from memory? Have they exploited a vulnerability in (Google) fscrypt, or LUKS? Or are these unencrypted phones? Or unencrypted cache partitions?