Erasing Android Phones Securely

[hark8751]

For curiosity's sake, I was wondering how an Android device can be securely erased (ie. before being sold, donated, recycled, etc.). The most obvious solution is the factory reset, but I understand that this just formats the data partition and guides the user through the process of setting it up again. Because of this (I think, anyways), some people have had success recovering data from devices that have been "erased" this way. The only other way I can conjure is this:

1. Encrypt the device with a long password. Make it random, and write it down somewhere. Do NOT select any "fast encrypt" options if they appear.
2. After encryption is done, shut the device down and boot to recovery. Choose the option to "wipe data/factory reset" and wait for it to complete.
3. Go through the setup process, skipping as many steps as possible, and entering fake personal information when forced to provide it.
4. Perform a factory reset from within "settings".
5. Remove the SIM card (if applicable) and SD card (also if applicable).
6. Destroy the copy of the password written down in step 1.

This way, I figure, any information that might be recovered after the factory resets is encrypted and useless without the password. But the questions that remain are:

1. Does Android overwrite all storage (including "free" space) when encrypting data?
2. What about wear leveling and other solid state related erasure impediments? Do these affect the security of this approach?
3. Would this be an effective way to totally erase all device data beyond recovery?

Thanks in advance for replies

 

[OutOfPhase]

You can completely wipe a device but it depends on the manufacture on how you do it. With Motorola's you flash the os with rsdlite or fastboot and it will be like it just came out of the box.

Also when you do an fdr there is an option to wipe internal data. The only thing an fdr does not touch is the system files, external sd-card and internal sd-card if the option is not checked.

 

[SkyJackpot]

For curiosity's sake, I was wondering how an Android device can be securely erased (ie. before being sold, donated, recycled, etc.). The most obvious solution is the factory reset, but I understand that this just formats the data partition and guides the user through the process of setting it up again. Because of this (I think, anyways), some people have had success recovering data from devices that have been "erased" this way. The only other way I can conjure is this:

1. Encrypt the device with a long password. Make it random, and write it down somewhere. Do NOT select any "fast encrypt" options if they appear.
2. After encryption is done, shut the device down and boot to recovery. Choose the option to "wipe data/factory reset" and wait for it to complete.
3. Go through the setup process, skipping as many steps as possible, and entering fake personal information when forced to provide it.
4. Perform a factory reset from within "settings".
5. Remove the SIM card (if applicable) and SD card (also if applicable).
6. Destroy the copy of the password written down in step 1.

This way, I figure, any information that might be recovered after the factory resets is encrypted and useless without the password. But the questions that remain are:

1. Does Android overwrite all storage (including "free" space) when encrypting data?
2. What about wear leveling and other solid state related erasure impediments? Do these affect the security of this approach?
3. Would this be an effective way to totally erase all device data beyond recovery?

Thanks in advance for replies

A description for one of the file shredders in the Google Play store reads:

"The application will over write the file once with random data. (It is not necessary to overwrite multiple times on SSD). The "Ghost Tracks" from magnetic media simply do not exist on solid stdte storage . Even on modem magnetic media it is not a practical concern anymore because of enormous data densities"

If you have root access and know the directory's to shred to shred the Gmail etc then you could do it with a file shredder and then flash the phone after you've finished shredding any data you don't wish to remain on the phone.