Every year, millions of people sell or trade in their old phones, laptops, and tablets. Most do a quick factory reset and assume they’re covered. Most are wrong. Studies consistently show that 40–60% of secondhand devices still contain the previous owner’s personal data — recoverable by anyone with a free tool and twenty minutes.
Short Answer: A factory reset alone is not enough for older Android phones and spinning hard drives — data can be recovered even after a reset. Modern iPhones, Macs with Apple silicon, and Windows 11 PCs with SSD encryption handle this correctly if you follow the right steps. This guide gives you the universal checklist for every device, plus what to do when a reset isn’t possible.
Real Breaches That Happened Because Someone Skipped This
These aren’t hypothetical warnings. They’re documented incidents involving real devices that were wiped incorrectly — or not at all.
The photocopier nobody thought about (2010)
CBS News bought used office photocopiers from a New Jersey warehouse. On one previously leased by Affinity Health Plan, they printed roughly 300 pages of personal medical records — prescriptions, test results, and a cancer diagnosis. A Buffalo Police Department copier held drug-raid target lists and sex-offender records. Affinity ended up notifying 409,262 people of the breach and reached a $1.2 million HIPAA settlement. The reason: almost every copier built since 2002 contains a hard drive that stores images of every document ever scanned. Almost no one thinks to wipe it before returning or selling the machine.
158 drives, half still readable (MIT, 2003)
Researchers Garfinkel and Shelat bought 158 used hard drives from eBay and flea markets. Of the ones that still worked, more than half contained recoverable files — including medical correspondence, love letters, and approximately 5,000 credit card numbers. This was the study that first proved “delete” does not mean “gone.”
It hasn’t got better (University of Hertfordshire, 2019)
Sixteen years later, researchers for Comparitech tested secondhand drives bought from eBay and used-device shops. 59% still held the previous owner’s data. A parallel Blancco/Ontrack study of 159 drives found 42% contained sensitive data and 15% had personally identifiable information — including one case where a security-cleared developer’s scanned family passports, birth certificates, and financial records were fully recoverable from a drive he thought had been wiped.
Factory reset isn’t enough for phones either
In 2014, Avast bought 20 used Android phones from eBay. Using free recovery software, they retrieved over 40,000 photos, 750+ emails and texts, 250 contacts, a completed loan application, and enough information to identify four previous owners — all from phones that had been factory reset before sale. University of Cambridge researchers separately showed that on 80% of Android phones tested, a factory reset left the Google master token intact — meaning someone could use it to access your Gmail account without your password.
Warning: These risks are not equal across devices. Modern iPhones with iOS 15+ and Macs with Apple silicon handle erasure correctly by design. The highest-risk devices are: older Android phones (pre-2016), spinning hard drives (HDDs) in any computer, SD cards and USB drives, and forgotten devices like printers, routers, and smart TVs.
Why “Delete” and “Factory Reset” Often Aren’t Enough
To understand why this happens, you need to know one thing about how storage works: when you delete a file or run a factory reset, most operating systems don’t actually overwrite the data. They mark the space as “available” and remove the pointer to the file. The data itself sits there untouched until something else writes over it. Free recovery tools like Recuva or PhotoRec can find and reconstruct that data in minutes.The exception is encryption. If your device encrypts all its storage — and you wipe it correctly — the encryption key is discarded along with the data. What’s left on the drive is encrypted gibberish that no recovery tool can read. This is why a properly executed wipe on an iPhone or a modern SSD-based Mac is genuinely secure: the encryption key is gone, and the data is permanently inaccessible.
The problem is devices that don’t encrypt by default (older Android phones, most spinning hard drives), devices where users skip the sign-out step before resetting, and devices nobody thinks of as computers at all — printers, routers, smart speakers, car systems.
The Universal 8-Step Pre-Sale Checklist
These steps apply to every device in some form. The device-specific guides below go into exact menu paths for each platform.Quick order:
Back up → Sign out everywhere → Pull physical media → Enable encryption → Factory reset or wipe → Verify with recovery software → Handle drives you can’t reset → Don’t forget hidden devices
Step 1: Back up what you want to keep
Before anything else: back up your data. Google Photos, iCloud, a local drive, an external SSD — pick your method. Don’t assume you can get it back after. Once you run the wipe, recovery requires the same forensic tools the attacker would use, and you’d need to know exactly what you’re looking for.
Step 2: Sign out and deauthorise everything
This is the step most people skip, and it causes two problems. First, if you leave Find My iPhone or Android’s Factory Reset Protection active, the new buyer’s device will be locked to your account — they can’t use it, and you’ll get angry messages. Second, leaving accounts signed in means your credentials remain accessible. Sign out of your Apple ID, Google account, iCloud, iMessage, FaceTime, any streaming services, password managers, banking apps, and any software with a license tied to your device (Adobe, Microsoft 365, etc.).
Step 3: Remove the SIM card and any memory cards
Your SIM card is not wiped by a factory reset. Neither is any SD card or external USB drive. Physically remove them before handing the device over. For phones, use the SIM ejector tool. For laptops and cameras, check for SD card slots. For smart TVs, check the USB ports for any drives you may have plugged in and forgotten.
Step 4: Turn on encryption if it isn’t on already
Modern iPhones encrypt storage by default. Macs with Apple silicon and T2 chips encrypt by default. Windows 11 on most modern hardware encrypts by default via BitLocker or Device Encryption. The risk group is: older Android phones (check Settings → Security → Encryption), Windows PCs with spinning HDDs, and any SD card or USB drive. If encryption is off on a spinning drive, running a factory reset or format will leave recoverable data. Turn encryption on first, then wipe.
Step 5: Run the proper factory reset or erase
Not all resets are equal. On iPhone, “Erase All Content and Settings” is the correct option — not just a passcode reset. On Mac with Apple silicon, it’s “Erase All Content and Settings” under System Settings → General. On Windows, it’s “Reset this PC → Remove everything → Remove files and clean the drive.” On Android, it’s Settings → System → Reset → Erase All Data, but see the Android guide below for the encryption prerequisite.
Step 6: For spinning hard drives and SD cards, verify with recovery software
After wiping a spinning HDD or an SD card, run a free recovery tool like Recuva (Windows) or TestDisk (cross-platform) on the drive before handing it over. If it finds recoverable files, you haven’t done enough — run a proper overwrite tool like DBAN for the HDD or reformat the SD card multiple times. This step is not needed for SSD-based devices where encryption was active during the wipe.
Step 7: Dead or broken device you can’t reset properly
If the device won’t power on, or the touchscreen is broken and you can’t navigate menus, you have two options. For hard drives and SSDs removed from a computer: connect them to another machine as an external drive and run a wipe tool directly. For a device you can’t access at all: physical destruction of the storage component is the only guarantee. For a phone, this means the internal storage chip. For a laptop, the hard drive or SSD. Drilling, shredding, or degaussing are all used commercially — for consumer purposes, drilling through the hard drive platters is sufficient.
Step 8: Don’t forget the devices nobody wipes
Your phone and laptop are not the only devices that store personal data. Printers store images of everything ever scanned or printed. Routers store your Wi-Fi password, connected device list, and browsing logs. Smart TVs store account credentials for Netflix, Amazon, and any other service you’ve signed in to. Game consoles store payment methods and account details. Smart home hubs store your home address, daily schedule, and Wi-Fi credentials. Car infotainment systems store your contacts, call history, navigation destinations, and any paired phone’s data. Most of these have a factory reset option buried in settings — use it before selling or returning.
Device-Specific Guides
Each of these links goes to a full step-by-step article for that specific device or platform. The steps above are the universal framework — the guides below give you the exact menu paths, model-specific differences, and common mistakes for each one.- How to wipe an iPhone before selling — covers Find My, Activation Lock, eSIM handling, Apple Watch unpairing, and the exact “Erase All Content and Settings” flow for iOS 15+
- How to wipe an Android phone before selling — covers the encryption prerequisite for older models, Factory Reset Protection, Google account sign-out, and Samsung/Pixel-specific paths
- How to wipe a Windows PC or laptop before selling — covers Windows 10 vs 11, the “Remove files and clean the drive” option, BitLocker, and when you need DBAN for spinning drives
- How to wipe a Mac before selling — covers Apple silicon vs Intel, Erase Assistant in macOS Monterey+, macOS Recovery for older Macs, and deauthorising iTunes/Apple ID
- The devices nobody thinks to wipe — full guide on printers, routers, smart TVs, game consoles, wearables, and car infotainment systems
How to Check If Your Wipe Worked
After wiping any spinning hard drive or older Android phone, test it before you sell. Download Recuva (Windows, free) or PhotoRec (cross-platform, free), point it at the wiped drive or phone storage, and let it scan. If it finds recoverable photos, documents, or files: you’re not done. If it finds nothing recognisable: the wipe was effective. For iPhones and modern Macs, this check isn’t necessary — the encryption design makes recovery impossible regardless of what a tool scans.The Free Pre-Sale Wipe Checklist
I put together a printable one-page checklist for each device type — Phone, Android, iPhone, Windows PC, and Mac — formatted so you can print it and tick off each step before handing your device over. It covers every step in this guide in a quick-reference format you don’t have to re-read the full article to use.Download the Free Checklist PDF ↗
Frequently Asked Questions
Is a factory reset enough to protect my data?
On a modern iPhone or Mac with Apple silicon, yes — if you follow the correct sign-out steps first. On older Android phones and any device with a spinning hard drive, no. A factory reset on these devices marks data as deleted but doesn’t overwrite it. You need to encrypt the device first, then reset, or use a dedicated wipe tool.
What if I can’t remember my password to sign out?
On iPhone, you can use Apple’s account recovery process at appleid.apple.com to reset your Apple ID before wiping. On Android, sign into your Google account from a browser and remove the device from your account there. On a PC, Microsoft and Apple both offer account recovery flows that work before you perform the factory reset.
Do I need to wipe my phone if I’m trading it in at a carrier store?
Yes. Carrier trade-in programs are supposed to wipe devices before resale or recycling, but you have no visibility into their processes. Your obligation is to protect your own data before it leaves your hands. Do the wipe yourself, then hand it over.
How do I wipe a device that won’t turn on?
If the device is completely dead, remove the storage component (hard drive or SSD from a laptop, or have a technician extract the storage chip from a phone) and wipe or physically destroy it separately. For phones where you can’t access the screen, many manufacturers have a hardware reset sequence (button combinations) that forces a factory reset without screen navigation — check your model’s manual.
What about selling to a recycling service instead of a person?
Reputable recycling and trade-in services (Apple Trade In, Gazelle, BackMarket certified resellers) have certified data destruction processes. That said, wipe the device yourself first. You don’t know who handles it at each stage of the chain, and the responsibility for your data starts with you.