By default, most data is protected using the AfterFirstUnlock class key, which certainly would be present on the device; but that's not what you're asking. You want to know what data is accessible, which is a different kettle of fish. In order to access the data, you either have to get the OS give it to you (by finding a lock screen bypass bug; not unheard of) or exfiltrate the class key from device memory somehow. That last bit is hard.
There are many exploits over the years that can give kernel-level code execution on an iOS device, but almost all of them require either unlocked physical access to the device or rebooting, which would clear the AfterFirstUnlock key from memory. The key is not encrypted in RAM, so opening the phone and accessing the RAM chip directly might work, except for the fact that the iPhone uses a package-on-package construction, and the RAM chip would have to be separated physically from the processor first--without destroying the data, so the chip would need power and/or to be frozen the whole time. The NSA might be able to pull this off, but it would take some seriously specialized equipment, and they'd only get one shot.
The USB interface offers many possibilities, as it carries IP traffic (yep, that's IP over USB) to potentially vulnerable applications. However, in iOS8 it's locked until you press "Trust this computer." If the attacker could steal the escrow keybag this creates off your already-trusted local computer, they could attack this way, but they's still need one exploit in a daemon to get code execution, another to break the sandbox, another to elevate to root, and another to patch the kernel.
Jailbreaks are much easier than this, because they can assume the user will help. That means they can use a trusted computer, and they can turn a file placement exploit into a code execution one by having the user tap an icon on their home screen.
Without user cooperation, your best bet is probably the network interface; you'll still require several exploits chained together, and you'll have to steal the password to your router to get the phone to autoconnect to the attacker's network, and then hope you don't have an always-on VPN set up.
Basically, iPhones are very secure. It's a matter of degrees, sure, but I'd still put your locked phone above almost anything but a smart card.
Edit: Source: mainly "iPhone Data Protection In Depth" by Bedrún and Sigwald, but I used to work on iOS security for the DoD. That's not to say we had special knowledge or anything (I wish, to Apple the DoD is a drop in the bucket), but I've certainly spent enough time probing the depths of the Data Protection system!
Edit 2: The biggest vulnerability in this whole system used to be the escrow keybag, which is created when you plug in to a computer and hit "Trust." This contains all the class keys you need to decrypt the phone's data, because iTunes needs to be able to back up the phone. The escrow keybag is encrypted with a random token stored on the phone, so it's normally only useful when transmitted back to the phone, but if you could just exploit something that would let you read that token back from the filesystem, you'd be in business. That said, in the 5S and later, the processor comes with a "secure enclave" that's more-or-less a smartcard built into the chip, which has its own keys. The escrow keybag's decryption key is now stored in an encrypted format, and only the secure element can decrypt it, so this avenue of exploitation has been closed.
