Factory resetting doesn’t wipe all your data: here's how you can
We here recommend a factory reset for a few Android issues: bugs following a fresh Android update, a regular housekeeping fix for maintaining Android performance and as a way to completely wipe your data from your phone. The problem is that Google's built-in factory reset option has problems that expose your data even after a reset. Here's why a factory reset doesn’t wipe all your data (and what you can do about it).
The factory reset problem was uncovered by some Cambridge University researchers in the first major study of this taken-for-granted Android security feature. The factory reset, we’ve always been told, will delete all data, accounts, passwords and content from your Android device. The problem is, this is only partially true.
Why does a factory reset not work?
The researchers tested a range of second-hand Android devices running Android versions from Android 2.3 to Android 4.3 and found that in all cases they were able to recover account tokens – used to authenticate you once a password is entered the first time – from service providers like Google, Facebook and WhatsApp. In a staggering 80 percent of cases they were able to recover the master token.
The master token is essentially the key to the front door, the equivalent of installing a top-notch security system and then hiding the key under the door mat. Once a master token is recovered, the user's credential file can be restored and all your data re-synced to the device: that means emails, cloud-stored photos, contacts and calendars.
How could this happen?
There are a few reasons. Part of the blame is with the manufacturers who simply don’t provide the software required to fully wipe flash storage. Likewise, flash storage is notoriously hard to wipe, and of course, Google is to blame for not providing a more fail-safe option for users.
The researchers went on to note that while security and antivirus companies may use these findings to promote their own tools and services that the only real solution was likely to come from the vendors themselves.
Unfortunately, even devices with built-in encryption are not safe from the weakness. The decryption key is also left intact on a device once it has been factory reset. While that key is itself encrypted, having access to it would be a matter of a few days’ worth of work for most hackers, according to the researchers.
Even Android phones running KitKat and Lollipop may be affected.
What can we do about it?
The main things one can do to protect themselves is to encrypt their phone and use a strong, randomly-generated password that contains a mixture of upper- and lower-case letters, numbers and symbols and is at least 11 characters long. The issue with this is that it is sufficiently awkward to do on a regular basis that most users simply won’t do it.
Alternatively, once a phone has been factory reset, the flash storage can be refilled with useless data to overwrite the tokens and crypto keys left in flash storage. Of course, the app used to fill the phone would need to be installed outside of Google Play to avoid a Google token being registered on the device once again. The only other solution the researchers came up with was to destroy the device.
This solution, however, raises issues for users that find themselves with a lost or stolen device, or for those devices that have been remotely wiped with Android Device Manager. Recommendations have been made to Google and OEMs and you can bet this topic will be raised at Google I/O 2015, Google's annual developer conference. In the meantime, just be careful who you sell your second-hand phone to.