Sure it says that all data will be gone, but it that true? According to Avast, android’s factory reset only wipes your phone on the application level or a quick format which using a using a small effort, data can be mined. So what can be done then?

Whenever you sell your phone or trade in, it is natural for you to do a factory reset to remove all the data quickly, like how you would for your harddiscs or even memory cards.

According to Avast researchers Jaromir Horejsi and David Fiser, they purchased 20 smartphones on eBay that had supposedly been wiped using Android’s factory reset, but they found that with digital forensics tools and a little effort, they could restore a lot of the previous owner’s data. In fact, not one of the phones were entirely clean. Here’s what they had to say:

Although at first glance the phones appeared thoroughly erased, we quickly retrieved a lot of private data. In most cases, we got to the low-level analysis, which helped us recover SMS and chat messages.

They extracted 40,000 images, including more than 750 partial or full nude images of women, and 250 nudes of men. In addition, 750 emails and texts, 250 contacts, the identity of four previous owners, as well as one completed loan application were retrieved.

This guy was really into anime porn

Caroline James says, who is a PR manager for Avast, while looking over pictures from one of the phones. In addition to the images, Avast was able to log into an owner’s Facebook, and track his previous whereabouts using GPS coordinates.

For this, all they did was use FTK imager, a digital forensics tool which can be downloaded free online, to extract the data. They also used the resources of the XDA developer forum, in which experts and programmers share their knowledge on mobile platforms. They also used Android’s own Android Debug Bridge as well as Android Backup Extractor, to make a backup all of a phone’s data to a computer without needing to unlock it, and then accessing the data.

Apparently, there is no way to properly degauss the data, but as a consolation, you can still make your data unreadable. You can do so by encrypting the device before performing the factory reset. Because, by resetting, it should delete the encryption key, and in theory, making any retained information inaccessible.

Via Tomshardware