They don't use encrypted data. They look at the metadata like packet size and timing and perform traffic correlation, which defeats Tor's primary purpose: hiding the connection between the source and destination of traffic.