Exploits, Tools & Data Recovery · Deleted vs Reset: Myths & Reality · Lesson 4 of 5

Selling or Recycling a Phone Safely

Hand over an old phone the right way, and see where scary reset stories began.

The steps, in the right order

Now that you know a modern reset really works, preparing a phone for a new owner is mostly about doing things in the right order. Skip a step and either the buyer gets a phone they can't use, or you leave a copy of your data behind.

For an iPhone, Apple's guidance comes down to this:

• Back up to iCloud or a computer, so nothing is lost.
• Unpair an Apple Watch if you have one.
• Sign out of your Apple Account. You saw in iCloud & Your Apple Account that this turns off Find My and Activation Lock.
• Erase with Erase All Content and Settings. If the phone uses an eSIM (a digital SIM built into the phone), Apple says to choose the option to erase it too.
• Remove the phone from the list of devices on your Apple Account.

For an Android phone, the idea is the same, with different names:

• Back up to your Google Account or a computer.
• Remove your Google Account from the phone. Google calls the anti-theft feature device protection, and it's widely known as Factory Reset Protection (FRP). Google says that after a reset, the phone asks for the old screen lock or the Google Account password before it can be set up. Some makers, Samsung for example, add their own account lock, so remove that account too.
• Take out the SIM and any microSD card. As the last module showed, a card may not be erased by the reset.
• Factory reset from Settings.

Why sign out before erasing? Because the anti-theft lock is the point. It's what makes a stolen, wiped phone worthless to a thief. If you erase without signing out, the phone still belongs to your account, and an honest buyer is stuck at a screen asking for your password.

Where the scary stories come from

If resets work, why do so many people believe they don't? Partly because of real studies that got wide coverage.

• In July 2014, the security company Avast said it bought 20 used Android phones on eBay that had been factory reset, and used publicly available forensic software to recover more than 40,000 photos, plus emails, texts and contacts. Google responded, as reported at the time, that the research appeared to be based on older devices and versions that didn't reflect the protections most users had.
• In 2015, Laurent Simon and Ross Anderson of the University of Cambridge studied 21 used Android phones running versions 2.3 to 4.3. They found flawed factory resets and estimated that up to 500 million devices might not properly wipe the area holding sensitive data. They also found that the encryption of that era was fragile when the reset was flawed.

Both studies were accurate for their phones. Those phones came from before encryption was switched on by default, which, as you saw, Android required starting around Android 6.0. On an unencrypted phone, a reset that only marks space as free really can leave photos behind. Very old phones are the honest exception to everything in this course.

The same goes for recovery apps that promise to restore everything. On a modern phone they generally can't read storage protected by keys that no longer exist. What they find tends to be items still in a trash folder, leftover thumbnails or caches, or copies in the cloud.

So what can the buyer of a properly erased modern phone see? A setup screen, the model, and its serial number or IMEI, the phone's hardware ID. Not your photos or messages. What they could see is whatever you forgot outside the phone's encryption: a microSD card or a SIM left in the tray.