When you buy a new smartphone and go to sell or donate your old one, you know you need to get rid of your personal data first—banking information, credit card numbers, pictures you sent to your doctor of that weird rash. Who knows. If you have an Android handset, the usual way to wipe everything and make your old device factory-fresh is with a default reset. But a new study shows that those factory resets aren’t actually clearing everything out.
Avast, which makes security software for Windows, Mac, and Android, recently bought 20 used Android handsets on eBay. Then company employees used digital analysis software that’s readily available and fairly easy to use to see if there was anything left on the 20 devices from the original owners. It turns out there was. Avast researchers found more than 40,000 photos, 750 emails or text messages, and 250 contacts. The group was also able to deduce the identities of the previous owners of four of the phones.
What they found wasn’t just cat pictures. Avast recovered 250 nude male selfies and an entire loan application that had been completely filled out. Jude McColgan, the president of mobile at AVAST, said in a statement, “The amount of personal data we retrieved from the phones was astounding… The take-away is that even deleted data on your used phone can be recovered unless you completely overwrite it.” McColgan further explained in an interview with CNET that Android’s factory reset removes data “only at the application layer” and doesn’t extend more deeply to rewrite a device’s entire memory.
It’s important to note that Avast makes its own reset software, which the company claims does a much better job of completely wiping Android devices. So part of the motivation for this study is presumably to promote Avast’s alternative service. Still, the results are pretty startling. Whether they make you want to buy Avast’s software or someone else’s, this test at least raises awareness of how hard it is to scrub personal data before reselling or donating old devices.
