Assessing data remnants in modern smartphones after factory reset

Abstract

It is commonly believed by end-users that factory reset on an electronic device restores the state of the device back to when it was shipped from the factory. Nevertheless, user data has reportedly been recovered after a factory reset by applying forensic data recovery techniques. In order to protect end-users’ privacy, smartphone manufacturers started implementing security countermeasures such as encryption. Specifically for Android smartphones, the encryption scheme advanced as the Android version became higher. Meanwhile, the effectiveness of a factory reset on a modern Android device has not been publicly explored. In this paper, the effectiveness of factory reset on modern devices running Android 11 or 12 is investigated. This is done by looking at low level differences on data extractions before and after creating data and after resetting a device. Results show that some parts of the encrypted data are still accessible in their binary form as not all data is reset to factory state. Furthermore, different partitions do not wipe data that was created during device usage, from which information about the use of a device may be deduced.