Exploits, Tools & Data Recovery · Deleted vs Reset: Myths & Reality · Lesson 2 of 5

Factory Reset & Crypto-Erase

See why a modern factory reset leaves the old data unreadable for good.

Why a reset takes seconds

Erasing a modern phone takes moments, even with hundreds of gigabytes stored. It doesn't scrub every byte. It destroys the keys.

Picture an apartment building where every door has its own key, and all those keys sit in one small lockbox. Melt the lockbox key and every apartment is sealed for good, without touching a single door. A phone's keys are arranged like that, in layers, with a few master keys protecting all the rest.

That only works if everything was encrypted to begin with, and modern phones do this by default:

• iPhone. According to forensic researchers who studied it, the iPhone 3GS (2009) brought hardware storage encryption designed for fast wiping, and iOS 4 (2010) added the per-file Data Protection you met in iOS Internals. Apple's documentation says erasing a device obliterates all the keys in Effaceable Storage, a small area built to be truly wiped, and renders all user data cryptographically inaccessible.
• Android. Google's documentation says full-disk encryption (FDE), one key for the whole data area, arrived in Android 4.4. The Android 6.0 compatibility rules required phones with a secure lock screen to support it, switched on by default when the chip was fast enough. Phones launching with Android 10 or later must use file-based encryption (FBE), and Android 13 dropped FDE entirely.

So on an iPhone using Erase All Content and Settings, or a recent Android phone using its factory reset, the old data may physically remain on the chip for a while. But it's encrypted with keys that no longer exist anywhere. Deleted or not, it can't be read back.

On the simulated phone, delete the photo and the chat, then press Factory reset. Read the status panel after each step and note what still holds a readable copy.

Crypto-erase, the formal name

Security professionals have a formal name for destroying keys instead of data. The US National Institute of Standards and Technology (NIST) publishes SP 800-88, its guide to media sanitization, meaning making data on storage unrecoverable. Revision 1 came out in 2014, and Revision 2 replaced it in September 2025. Both describe cryptographic erase, often shortened to crypto-erase. NIST's glossary defines it as a purge technique that sanitizes the keys protecting encrypted data.

Why not just overwrite everything instead? You saw in Mobile Forensics that flash storage manages itself with commands like TRIM. The chip's controller also spreads writes across its blocks to avoid wearing any one out, and it keeps spare blocks the phone can't directly address. Overwriting a file may simply write the new data somewhere else, leaving the old copy in a block you can't reach. Destroying the key sidesteps all of that. It doesn't matter where the scrambled bytes ended up.

NIST's Revision 2 FAQ adds an important condition: crypto-erase only counts if no sensitive data was stored on the media in plain, unencrypted form before the keys were set up. Keep that in mind, because it's exactly where the old myth came from. Phones that stored data unencrypted, or were encrypted only later, may leave readable leftovers that no key covers. You'll see real examples in the last lesson.

Two more limits are worth knowing:

• It only covers the phone's own storage. Cloud backups, synced photos and the other person's chat are separate copies. The next module maps them.
• Removable cards can be different. A memory card that wasn't set up as part of the phone's internal storage may not be encrypted at all.

The short version: on a modern phone, the reset is real. What survives a reset survives somewhere else.