Encrypted data at rest is information stored on a device or storage medium that has been transformed using encryption so it cannot be read without the required key. It differs from data in use, which is being processed, and data in transit, which is moving across a network. Phones may use hardware-backed encryption to protect files when the device is locked or powered off.
This protection limits the value of a stolen device or storage drive, but it does not make data theft impossible. Attackers may seek the decryption key, exploit weaknesses in the boot chain or operating system, or access data after it has been unlocked. A hardware flaw alone does not prove that encrypted files or a wallet recovery phrase were decrypted. Defenders should use strong device passcodes, keep recovery phrases out of ordinary phone notes and screenshots, and store backups securely offline.