Your old phone still knows everything about you
Have you ever sold a used smartphone? Or handed it down to a friend or a family member, maybe after “resetting” it?
The factory reset isn’t what you think it is.
On many traditional Android devices, restoring the factory settings wipes your access to the data — but not the data itself. Photos, messages, saved credentials, browsing histories: they remain physically in the device’s memory, invisible to the eye but recoverable with tools within reach of anyone who has a bit of technical know-how. There are free apps designed for exactly this purpose.
The problem isn’t the reset. It’s how the system is built.
When you delete a file, the operating system doesn’t destroy it. It marks that space as “free” and waits for something else to overwrite it. Until that happens, the data is still there.
This applies to any device: smartphones, laptops, external hard drives, USB sticks.
Mechanical hard drive: the method exists, and it’s free
If you’re retiring a computer with a traditional hard drive — the kind with moving parts — you’re in luck. In this case, overwriting the data securely is technically possible and accessible.
The most reliable tool is called nwipe: available on Linux, it overwrites every sector of the disk with random data, making recovery practically impossible. If you don’t want to install anything on the computer you’re wiping, there’s ShredOS — a system that boots directly from a USB stick and launches nwipe automatically. Plug in the stick, reboot, follow the instructions. No installation, no technician required.
SSDs, smartphones, and flash memory: a different story
Modern smartphones — and most laptops from the last few years — use flash memory. And there, things get complicated.
Flash memory has a mechanism called wear leveling: to prevent some cells from wearing out faster than others, the system distributes writes intelligently across the entire memory. The result is that not even the operating system knows for certain where a file was physically written. Overwriting “that space” isn’t guaranteed, because that space isn’t fixed.
For SSDs there’s the ATA Secure Erase command, often accessible from the computer’s UEFI menu. For NVMe drives, you use nvme-cli from the terminal. But on smartphones, USB sticks, and SD cards, often the only truly secure solution is the physical destruction of the medium.
The only real defense is preventive encryption
If the device is encrypted from the start — that is, from the very first time you turn it on — the problem changes in nature. Even if someone recovered the raw data from the memory, they’d be faced with incomprehensible sequences without the key. On an encrypted device, the factory reset becomes truly final: it deletes the key, making the data inaccessible forever.
This is exactly why, on GrapheneOS, encryption is enabled by default from the very first boot. It’s not an option to hunt for in the menus. It’s the starting point.
Before selling, giving away, or throwing out a device
Whatever the device, follow this order:
- Back up whatever you want to keep, onto a medium you control
- Sign out of all accounts (Google, Apple ID, or equivalents)
- Verify that encryption is enabled
- Only then perform the factory reset
If you’re not sure your current smartphone handles this properly — it probably doesn’t.
Our devices ship already configured with encryption enabled, Google accounts removed, and an operating system that doesn’t collect data about you. If you’re thinking about switching phones, start with your next one. As for the old one, write to us: we’ll tell you how to handle it before you get rid of it.