In 2015, researchers bought more than 120 used phones off the open market and went looking for what the previous owners had left behind. On 35 percent of them, they recovered real data, text messages, emails, photos, the works, on devices whose owners believed they had wiped them clean. As one of the researchers put it, a factory reset often just removes the table of contents. The chapters of the book are still sitting there, waiting to be read.

That is the uncomfortable half of the truth about deleting things. The reassuring half, which almost nobody understands, is that on a modern phone, done right, a wipe genuinely can make data unrecoverable, even to a forensics lab. The gap between those two outcomes is the whole subject of this post, and understanding it is the difference between actually erasing your phone and just believing you did.

Why “delete” doesn’t delete

When you delete a file, the system usually does not touch the file. It removes the pointer, the entry in the index that says “this data lives here,” and marks that space as available for reuse. The data itself stays in the storage until something happens to overwrite it, which might be soon, or might be months, or might be never. Until then, forensic recovery tools can walk right past the missing index and read the raw contents. Deleted, in the everyday sense, means hidden, not erased.

The old-school fix for that was to overwrite, write junk data over the file’s location so the original is physically replaced. On the spinning hard drives of twenty years ago, that worked. On the flash storage in every modern phone, it largely does not, and this is the part that surprises even technical people.

Flash memory uses a controller that constantly moves data around to spread out wear and keep the chip healthy, a process called wear-leveling. Because of it, when you try to overwrite a file, the controller frequently writes the new data to a completely different physical location and leaves the old copy sitting in a cell the operating system can no longer see, but a lab reading the raw chips still can. The government’s own standards body, NIST, says this plainly: on flash-based storage, spare cells and wear-leveling make it infeasible for a user to sanitize data by overwriting, because the drive, not you, decides where writes land. The classic “secure erase by overwriting” ritual is effectively dead on phones.

So if deleting does not erase, and overwriting does not reliably erase, how does anything actually get erased?

The modern answer: kill the key, not the bytes

Here is the elegant part. Every modern phone encrypts its entire contents by default, with strong AES-256 encryption, and has for years, since iOS 8 and Android 6. The key that decrypts all of it is not sitting in ordinary storage; it lives in dedicated secure hardware, the Secure Enclave on iPhones, a hardware-backed keystore or trusted execution environment on Android.

Now watch what a factory reset actually does. It does not scrub your data cell by cell. It destroys that encryption key. And the instant the key is gone, every byte of your leftover data, all those un-overwritten chapters still sitting in flash, becomes unreadable noise. It does not matter that the encrypted remnants are still physically present, because without the key they are cryptographic gibberish that no lab can turn back into your photos.

This technique is called cryptographic erase, and it is not a marketing shortcut. NIST, in the media-sanitization guideline that US federal agencies use to decommission drives, rewritten as recently as September 2025, classifies cryptographic erase as a Purge-level method, meaning recovery is infeasible even with state-of-the-art laboratory techniques. That is why a phone wipe that finishes in thirty seconds actually outranks an hour of overwriting. You are not trying to destroy a haystack. You are burning the one key that made the haystack readable.

So the honest, non-obvious answer to “is my data gone after a factory reset?” is: yes, genuinely gone, if the conditions are met. And the conditions are where people get burned.

The conditions, and where it goes wrong

The phone had to actually be encrypted. NIST attaches one blunt caveat: cryptographic erase is only as good as the cryptography underneath it. A modern, properly configured phone is doing purge-grade erasure. A cheap or old device with encryption switched off, or implemented poorly, is doing nothing of the sort; its factory reset just removes the map and leaves the territory intact. Those 120 used phones from the study were largely older or flawed devices where the encryption was absent or the reset was broken. Cambridge researchers even found cases where a flawed factory reset left behind enough data to recover the encryption key itself, which defeats the entire point.

The device has to work. Cryptographic erase happens when the phone runs the reset. A phone with a dead screen or fried board never runs it, so the data sits fully intact on the chips for anyone who desolders them. A broken phone in a drawer is not a wiped phone.

You have to kill the copies, too. This is the one that catches careful people. Cryptographic erase destroys the data on the device. It does absolutely nothing to the copies elsewhere. If your photos synced to the cloud, your messages backed up to a server you forgot you were using, your files mirrored to another device, wiping the phone leaves every one of those untouched. The same goes for a message you “delete”, it vanishes from your screen, not from the recipient’s phone or the provider’s servers.

There is also a horizon-level caveat worth one sentence: cryptographic erase assumes the encryption holds, and a sufficiently advanced future adversary harvesting today’s encrypted “noise” could, in principle, revisit it if the cryptography is ever broken. Not a concern for a phone headed to a family member; worth knowing for data that must stay secret for decades.

The reframe

Put it together and the old slogan needs updating. “Deleted isn’t gone” is true, at the file level, and on unencrypted or broken devices. But erasing a modern phone was never about overwriting bytes, a thing flash makes nearly impossible anyway. It is about two things: controlling the key, and controlling the copies. Win those and gone means gone. Ignore either and “delete” is theater.

This is where how a device is built matters more than which button you press. On a properly hardened phone, the data was encrypted from the first boot, with real, verified encryption you do not have to wonder about, so a factory reset is a true cryptographic shred rather than a hopeful gesture. Even if someone pulled the raw flash chips, they would find only noise. And when the device is not quietly backing everything up to a cloud you did not think about, wiping it is not silently undermined by a pristine copy sitting on someone else’s server. “Gone” can actually be gone, because the encryption was real, the key destruction is real, and there is no second copy rewriting the ending.

Contrast that with the common situation: a phone where you are not certain encryption was fully on, that has been dutifully syncing your entire life to the cloud the whole time. You factory reset it, hand it off, and feel safe, while the important copy was never on the phone at all.

What to actually do

To make data on a phone genuinely gone: use a device with real full-disk encryption, so the reset has a key worth destroying. Then a standard factory reset is your secure wipe, do not waste time on overwriting apps, they do not work on flash. Before you sell, donate, or dispose of a phone, sign out of and delete the cloud accounts and backups that hold the real copies. For a dead or high-sensitivity device, physically destroy the storage, because a reset it cannot run protects nothing. And remember that buying a used phone means someone else’s incomplete wipe may have left their data waiting for you, one more reason we source and build the way we do.

Deleting is not erasing. But erasing is very achievable, once you stop thinking about scrubbing bytes and start thinking about the key and the copies. If you want a phone where a wipe truly wipes, because the encryption is real and nothing is quietly keeping a copy, that is what we build. Email hello@spicycorp.com, or book a call.