So the burden of proof is on the defendant here? Shouldn&#x27;t the state have to prove that he does indeed know the passcode and refuses to reveal it, rather than have the defendant prove that he forgot it?