You haven't mentioned which platform, but seeing as you used the term passcode I'll assume iOS. Other platforms are probably similar.
There's considerable detail about the encryption and security features of iOS here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf
In addition to unlocking the device, a passcode provides entropy for
certain encryption keys.
(NSFileProtectionComplete): The class key is protected with a key
derived from the user passcode and the device UID. Shortly after the
user locks a device (10 seconds, if the Require Password setting is
Immediately), the decrypted class key is discarded, rendering all data
in this class inaccessible until the user enters the passcode again or
unlocks the device using Touch ID.
Basically, the passcode is used as a decryption key - if the wrong passcode is entered decryption will fail. If decryption succeeds then the passcode is valid.
Can forensic analysts simply retrieve the passcode in authentic form
and use it to decrypt the rest of the device?
No, you'll only be able to decrypt the other keys by knowing the passcode first.