Factory Reset doesn't wipe Android phone/tablet data!

[Lehyun]

I did a quick search and I couldn't find any threads on this so I thought I'd start one.

Before selling my old phones I'd wipe the memory by doing a factory data reset for security reasons, I mean who wants their stuff snooped on by the new owner right?

Being a little suss that the whole process only takes a few minutes I did a quick search and found this.

A group at Avast bought a bunch of phones from eBay and recovered data (including some guy's schlong-selfy) that was supposed to have been deleted. According to them "When a file is deleted [through a factory data reset or by other means], the operating system just deletes the pointers corresponding to that file and marks the space that will be overwritten when another file is stored. [It doesn't actually delete the data]" Avast is saying that they have the software that can permanently delete your junk, but apparently there are a few other methods too...

one) Before you do a factory reset, encrypt your phone first (then go ahead with the reset as normal). This will effectively throw away the encryption key making it harder for the spooks to get your data

or two) if you've already gone ahead with the data reset, you can try to fill your device with benign data to overwrite your files

My question is has anyone tried any of the software out there or do you think the above mentioned would actually work?

Thanks

Edit: not sure if this is the right section! ><

 

[corkyg]

Good info, but better off in MD&G.

 

[KeithP]

All you have to do is turn on encryption.
http://www.zdnet.com/article/securely-wiping-an-android-smartphone-or-tablet/

Surprise, surprise, Avast doesn't mention that. They rather have you buy their software. By the way, I am looking for a new job...is Avast a good employer to work for?

-KeithP

 

[Graze]

I thought the whole encrypt then wipe thing was already known to the Android tech community?

 

[TripleThreatTLT]

I thought the whole encrypt then wipe thing was already known to the Android tech community?

Maybe the tech community. To the average user though, probably not so much.

 

[kyrax12]

Interesting. Why doesn't android have a better way of deleting files in the later versions? I would have think, the developers would know of this problem by then.

 

[WelshBloke]

Thats how all OSs (desktop as well) delete files.

On a different note I always include a selection of "schlong-selfy"'s when I sell a phone!

 

[BarkingGhostar]

Is it in Google's best interest to allow you to delete your data? I wouldn't think so since their entire business is information, yours, mine everybody's.

 

[JeffMD]

Err, solid state memory does not work this way. ^^

 

[Lehyun]

All you have to do is turn on encryption.

Yeah but I've already wiped my phone, will that still work?

By the way, I am looking for a new job...is Avast a good employer to work for?

lol, yes but they're not hiring at the moment - I only got the job as a freelancer

nteresting. Why doesn't android have a better way of deleting files in the later versions? I would have think, the developers would know of this problem by then.

mmmm, google says the later devices are more* secure with the wipe, but they didn't specify how much...

edit:

Thats how all OSs (desktop as well) delete files.

Yeah but you can format a pc, phones should have a similar option built in. Apparently iPhones don't have the same security issues with their wipe. Just saying.

On a different note I always include a selection of "schlong-selfy"'s when I sell a phone!

haha, that's gross.. you don't have any for sale atm do you? >>

 

[Graze]

Never mind

 

[destrekor]

Yeah but I've already wiped my phone, will that still work?

Yes, if you encrypt your data and then perform a factory reset, your encryption key is completely wiped from the phone. So while the actual data may still reside on the storage, it cannot be recovered because if someone performed a data recovery routine, they would only see jumbled useless data and have no means of decrypting it.


I did this for an Android phone I recently sold, but I also went a step further. I didn't want to rely on the fact that the encryption key would be wiped or that the data could never be recovered, so I performed some kind of write routine, I think using ADB, that filled the entire internal storage with random data. I may have done this a couple times just because (once is perfectly enough in modern storage mediums, including HDDs, as long as you do it right).

I cannot remember what command(s) I used, but I do know that I:
encrypted phone
factory reset
completely wiped phone 100% clear with random data
flashed new factory ROM

The only issue about the above routine is that it requires an unlocked bootloader, and on some devices, even with some means of re-locking the bootloader, there may still be a notice at boot that the device is unlocked. At least, that was true for my Moto X that I wiped and sold.

mmmm, google says the later devices are more* secure with the wipe, but they didn't specify how much...

edit:


Yeah but you can format a pc, phones should have a similar option built in. Apparently iPhones don't have the same security issues with their wipe. Just saying.

iPhones do not have this problem, at least not recent models, because all of them encrypt user data by default. So whenever someone performs a factory reset to sell or trade in a phone, it does the same thing I described above.


Also, regarding recent Android changes:

It is best to check your phone to see if encryption is turned on. For the Nexus devices, it is almost surely set to Encrypt by default, but for Lollipop, Google actually backed down from making it's use mandatory. Instead, they require all hardware going forward to be capable of encryption, but they are not forcing third-party OEMs to actually enable it out of the box. So Nexus devices will have it on by default, but other phones it will likely be hit and miss. I read that for the Moto E, it hurt overall phone performance.

 

[Zahid Iqbal]

Do a hard reset otherwise contact with a technician