Does a Factory Reset Erase Everything? (September 2026) Complete Guide

If you’ve ever wondered does a factory reset erase everything on your phone, the short answer is no, not always. A factory reset removes your access to files, apps, and accounts, but it does not guarantee that the underlying data is physically destroyed. On older or unencrypted devices, that residual data can sometimes be recovered with off-the-shelf forensic tools.

I dug into the research behind factory resets, including the often-cited Cambridge University study on Android data remnants, and compared what modern iPhones and Android phones actually do. In this guide, I’ll walk you through exactly what a factory reset does, what it leaves behind, and the concrete steps I take before selling, donating, or recycling any device.

What a Factory Reset Actually Does?

A factory reset returns your phone to the state it was in when it left the box. The operating system reinstalls its default settings, every app you installed disappears, and the file references tied to your photos, messages, and accounts get cleared.

Behind the scenes, the reset process tells the storage controller to mark all user data blocks as “empty.” The files themselves are not actively destroyed during this step. Think of it like removing all the labels from a library’s card catalog. The books are still on the shelves, but nobody can find them through normal means.

This is the core reason the question “does a factory reset erase everything” has such a nuanced answer. On modern encrypted phones, those orphan blocks are unreadable garbage. On older devices without full-disk encryption, forensic software can sometimes piece them back together.

What Gets Deleted vs What Stays?

Here’s the practical breakdown I use when evaluating whether a reset is “enough.” This distinction matters whether you’re troubleshooting a buggy phone or wiping one before sale.

The bottom row is the one most people miss. Factory reset protection stays on by default, which is good for theft prevention but means a buyer cannot skip your Google or Apple ID sign-in.

Logical Deletion vs Physical Deletion

The factory reset relies on what security researchers call logical deletion. The operating system drops the pointer to a file, frees up the block in its index, and tells the storage layer “this space is available again.” Nothing is written over the underlying bits.

Physical deletion is different. It actually overwrites every block with zeros, ones, or random data, sometimes multiple passes. Tools like DoD 5220.22-M wipes and the NIST 800-88 “Clear” and “Purge” standards fall into this category.

Flash storage complicates things further. SSDs and the UFS chips inside modern phones use wear leveling, which spreads writes across the chip to extend its lifespan. A logical delete does not trigger wear leveling, so the original bits can sit on the chip for months or years until that physical location is reused. This is exactly why a forensic recovery tool running on an unencrypted, factory-reset Android phone can sometimes resurrect old photos.

Why Data Can Still Be Recovered After a Reset?

The most cited evidence comes from a 2012 Cambridge University research project led by Simon Knight. The team bought 21 used Android handsets, ran factory resets on each, and attempted data recovery with widely available forensic tools. They pulled Google account tokens, SMS messages, and conversation threads off more than 80% of the devices.

That study is now over a decade old, and the phone market has changed dramatically. Every modern iPhone running iOS 8 or later ships with hardware-accelerated AES-256 encryption tied to a unique device key. Pixel phones, Samsung Galaxy flagships, and most current Android 10+ devices enforce full-disk encryption by default as well.

On those newer encrypted devices, data recovery after a factory reset is effectively impossible with consumer or even most commercial forensic tools. Without the encryption key (which is destroyed during the reset), the leftover blocks are unreadable noise. So when someone asks me today “does a factory reset erase everything,” the honest answer depends entirely on the phone in question.

The Role of Encryption in Protecting Your Data

Full disk encryption is the single biggest reason residual data has become a non-issue on modern phones. When encryption is enabled before the reset, every file is stored as ciphertext. The encryption key, not the data itself, is what makes files readable.

During a factory reset on an encrypted device, the key material gets wiped. Even if the encrypted blocks still sit on the flash chip, they are mathematically unreadable. Brute-forcing a 256-bit AES key is not a realistic threat with current technology.

This is also why the Cambridge-era findings do not translate cleanly to today’s phones. Researchers at Avast attempted a similar experiment in 2026 and recovered only a handful of files, all from outdated Android versions without enforced encryption. If your phone runs a current iOS or Android build, you are in a very different threat landscape than the study suggested.

Android vs iOS: Which Reset Is More Secure?

iOS has had hardware encryption since 2014, baked into the SoC on every device from the iPhone 5s onward. Running a factory reset on an iPhone therefore destroys the encryption key, which makes post-reset recovery practically impossible.

Android is more fragmented. Google has required full-disk encryption on most devices shipping with Android 6.0 and later, and Android 10 made it mandatory for all new devices. Older phones, budget models, and devices stuck on Android 5 or earlier may run unencrypted flash storage, which is where residual data can survive.

If you are wiping an Android phone, check Settings > Security > Encryption before you reset. If it shows “Encrypted,” you are protected. If the option is missing or greyed out, your device is likely old enough that a simple factory reset is not enough on its own.

What a Factory Reset Does NOT Remove?

Beyond the data recovery question, several things stay on your phone no matter how many times you reset it. These are easy to overlook:

• The operating system itself and preinstalled system apps (Gmail, Messages, Camera, etc.)

• Firmware and bootloader partitions, including any carrier bloatware baked into the modem

• Hidden diagnostic or repair partitions used by service centers

• Factory Reset Protection (FRP) lock tied to your last Google or Apple ID

• Warranty and serial number records stored in non-volatile memory

This list matters when you are evaluating whether a reset alone is sufficient for selling, donating, or recycling your device.

Cloud Data, SD Cards, and SIM Cards

Factory reset has zero effect on three categories of storage, and I see people get burned by this constantly.

Cloud data lives on Google, Apple, or third-party servers, not on your phone. Resetting the device simply removes its synced copy. Your Gmail, iCloud Photos, Drive files, and WhatsApp backups all remain accessible the moment you sign in elsewhere. If you want to wipe that data, you have to do it from the cloud account itself, usually under Settings > Manage Account > Delete Account.

SD cards are a separate physical storage medium that Android often formats as “external storage.” A factory reset does not erase SD card contents unless you specifically choose the “erase SD card” option during the reset flow. On Samsung Galaxy phones, this box is unchecked by default. Pull the card out before you sell or wipe the card separately with full formatting.

SIM cards store your phone number, carrier info, and saved contacts in older phones. They are unaffected by factory resets because the operating system cannot write to them. If you are recycling an old phone with a SIM inside, pull it out and physically destroy it, or transfer it to your new device.

Factory Reset Protection (FRP) and Malware Survival

Factory Reset Protection is a feature added to Android 5.0 and iOS 7 in response to rising phone theft. After a factory reset, the device requires the previously signed-in Google or Apple ID credentials before it can be reactivated.

For honest users, this is mostly an annoyance if you forgot your password. For thieves, it makes a wiped phone a brick. You can confirm FRP is active by checking that “Lock” or “Find My” is enabled in your Google or Apple settings before the reset.

A separate concern is malware. A factory reset removes almost all consumer-grade malware, including spyware, banking trojans, and most stalkerware because they live in the user data partition. Two categories can survive a reset: rootkits that infiltrate the firmware, and pre-installed malware shipped from the factory (a rare but documented supply chain risk). If you suspect a firmware-level compromise, a full reflash by the manufacturer is the only reliable fix.

How to Securely Erase Your Phone Before Selling It?

If you are selling, donating, or recycling your phone, factory reset is a starting point, not the finish line. Here is the process I follow with every device I hand off.

1. Back up everything you want to keep. Use Google One, iCloud, or a wired transfer to your computer. Verify the backup completes and that key files actually show up.

2. Sign out of every account. Google, Apple ID, Samsung, Microsoft, social apps, banking apps. Signing out invalidates session tokens and reduces stored credentials.

3. Disable screen lock and remove biometrics. Turn off PIN, pattern, fingerprint, and Face ID. This prevents a stuck lock screen on the next user.

4. Encrypt the device (Android only). Settings > Security > Encryption. On modern iPhones, this is automatic.

5. Sign out of cloud services specifically. On iPhone: Settings > [Your Name] > Sign Out. On Android: remove your Google account under Settings > Accounts.

6. Eject and physically remove the SD card and SIM. They are not affected by reset and need separate handling.

7. Run the factory reset. Settings > System > Reset > Erase All Content (iPhone) or Settings > System > Reset Options > Erase All Data (Android).

8. Confirm the device is locked. Boot it back to the welcome screen and check that it asks for the previous owner’s credentials before setup.

Following this checklist brings even older phones close to the same level of protection as a freshly manufactured unit.

Risks and Limitations of Factory Reset

The biggest drawback of factory reset is also its central feature: it is destructive. You cannot preview it or roll it back. If your last backup was incomplete, you lose that data permanently.

There are also secondary costs. Resetting forces you to re-enter Wi-Fi passwords, re-pair Bluetooth devices, and reconfigure two-factor authentication on accounts that track device fingerprints. For most people this is a minor inconvenience, but on a work device it can mean an hour of IT setup.

From a security perspective, factory reset is a single point of failure for anyone who skips account sign-out. A reset without signing out of Google first will trigger Factory Reset Protection, which can lock the next user out of a usable phone and turn into a support ticket.

Finally, factory reset is not the same as secure erase. If you handle regulated data, financial records, or any information covered by HIPAA, GDPR, or PCI-DSS, run a NIST 800-88 Purge-level wipe or use a certified mobile data erasure service.

FAQs

The Bottom Line on Whether a Factory Reset Erases Everything

So, does a factory reset erase everything on your phone? On modern encrypted devices, yes, for all practical purposes. On older or unencrypted phones, not always. Recovery is possible with the right tools and expertise.

Before you sell, donate, or recycle any device, run through the secure reset checklist above, pull your SD and SIM cards, and confirm your accounts are signed out. If the phone is more than seven years old, consider a NIST Purge wipe or a certified mobile erasure service for total peace of mind.