Sanitizing sensitive information: deletion, reset and device retirement

Emptying the trash usually does not destroy data forever. Before you sell a device, back up what you still need and use a factory reset on a disk that was already encrypted, and clean cloud copies separately. When an operating system “deletes” a file it often only marks the space as free; the old contents can stay readable until they are overwritten or left behind without the encryption key.

See encryption in encrypting stored files and backups in backups you can restore. Without a tested backup, a reset means lost work, not security.

Ordinary deletion is often not enough

Dragging a file to the trash and emptying it is not sanitization for something that should not reach the next person. On a mechanical disk the data may still be readable with recovery tools. On solid-state storage the behavior is more complicated, and “secure file shredder” apps do not always do what they advertise. The practical path for a whole device is that the disk was already encrypted and then all content is erased with the official reset; the old key no longer lives on the device and leftovers are useless to the next person.

• Deleting a file in a messenger does not necessarily remove the copy in the gallery or in a cloud backup.
• Emptying a cloud drive’s trash often keeps the file in “Recently deleted” for days.
• A quick format of a flash drive without encryption is not enough for sensitive data.
• Do not install an unknown “secure eraser” from an advertisement; it can be a risk itself.

Finish the backup before any wipe

1. Store what you still need in a place independent of this device.
2. Test restoring one file.
3. Keep passwords, backup codes and the encryption recovery key off the device you are about to erase.
4. If Find My is on, remove the device from your list in the account after the wipe so the buyer is not left with Activation Lock—and sign out before you sell.

See that encryption is on before you reset

1. On iPhone a device passcode must be on; without it, full encryption does not do the job you need.
2. On Android a PIN or password screen lock usually comes with encryption. Check that under Security settings.
3. On Windows open Privacy & security settings and read Device encryption or BitLocker. If it is off, turn it on before the reset and wait until encryption finishes.
4. On a Mac, check FileVault under Privacy & Security.
5. Do not sell the recovery key with the device or leave it in the box.

Erase an iPhone or iPad for sale or donation

1. If an Apple Watch is paired, unpair it from the phone.
2. Make a backup if anything still needs to be kept.
3. Go to Settings > General > Transfer or Reset iPhone and choose Erase All Content and Settings.
4. Enter the device passcode and, when asked, the Apple ID password so Find My and Activation Lock do not remain for the next person.
5. Wait until the device reaches the initial setup screen. Turning it off in the middle leaves the wipe unfinished.
6. From another device, sign into icloud.com or the Apple account and see that this device has left the list. If it remains, remove it.

Android

1. Remove the Google account and other accounts from Settings, or at least know that resetting without signing out can leave Factory Reset Protection for the buyer. For a sale, remove the account and then reset.
2. Take out the memory card and SIM; they are not erased by resetting the phone.
3. Go to System settings, Reset options, and run Erase all data (factory reset). On some Samsung devices this path is under General management.
4. Enter your PIN or pattern to confirm, and wait until the device returns to the initial screen.
5. From the Google account on another device, remove the sold device from Your devices if it is still listed.

Windows

1. Open Settings > System > Recovery > Reset this PC.
2. Choose Remove everything, not only your files, if the device is leaving the house.
3. If there is a Clean data or Clean the drive option and the data was sensitive, choose that; it takes longer and is more complete than a shallow reset.
4. When it finishes, the device should reach the initial setup experience.
5. From account.microsoft.com remove the device from the account and from Find my device.
6. Do not give the buyer a separate disk or recovery flash drive if it still holds keys and data.

Mac

1. On recent Macs go to System Settings > General > Transfer or Reset and choose Erase All Content and Settings.
2. Confirm with the Apple ID so Find My does not lock the next person out.
3. If an older Mac does not have that option, erase the disk in system Recovery and reinstall; have FileVault on beforehand.
4. Check the device list in the Apple account from another device.
5. Decide separately about a Time Machine disk: keep it encrypted, or erase it too. Selling the Mac with that backup disk beside it hands over both.

Clean cloud copies separately

Resetting a phone does not delete photos in iCloud or Drive. The other way around, deleting from the cloud does not remove a backup on a computer.

1. In a cloud drive or photo library, delete sensitive files and also empty Recently Deleted or the trash.
2. If chat backups went to Google Drive or iCloud, find them in that messenger’s settings and in the cloud itself, and delete them if needed.
3. Check contact, calendar and notes sync in the accounts.
4. Find old mailbox exports and Takeout or archive files on the computer and delete them if they should not remain.
5. Review third-party apps that have cloud access on the account security page.

Flash drives, memory cards and external disks

1. If the data was sensitive, encrypt the flash drive and then format it, or retire it if you no longer need it.
2. Format or destroy a phone’s memory card separately; a phone reset does not always touch it.
3. Treat a backup disk with the same sensitivity as the device itself.
4. Do not plug an unknown or promotional flash drive into your device “just to wipe it.”
5. For highly sensitive data on a piece that should no longer be used, physical retirement is more reliable than trusting a quick format.

Paper, printers and hidden copies

1. Shred paper instead of leaving it in a hallway bin.
2. Clear job history on a multifunction copier if you scanned a sensitive document.
3. Search the phone gallery for screenshots and photos of documents; many “deletions” left a copy there.
4. Empty the Windows Recycle Bin and the Mac Trash if you only removed a few files by hand and have not done a full reset yet.

Unlink accounts from the device

1. Before or during the reset, sign out of the Apple ID, Google and Microsoft accounts so Activation Lock does not bother the buyer and your session does not stay on the device.
2. After you hand it over, review and close sessions from another device.
3. Remove messengers linked to a computer from the linked-devices list.
4. Take out the SIM; the number and SMS recovery should not leave with the sold phone.

Repair, loan and recycling

1. If the device is only going for a short repair and must stay usable, a full reset may not be possible. Sign out of sensitive accounts, back up, and change the passcode when it returns.
2. For recycling or e-waste, do the same reset on an encrypted disk. A raw device that will not power on and was never encrypted should be retired if it held sensitive data, not passed to a parts buyer.
3. Wipe or return a work device according to the organization’s policy; sometimes IT must perform the reset.

Common mistakes

• Selling a phone after deleting icons, without a reset.
• Resetting without signing out of Find My and then hearing from the buyer that the device is locked—or, worse, resetting an old computer that was never encrypted.
• Forgetting the memory card, a flash drive and the Time Machine disk.
• Assuming that deleting a photo from the gallery removed it from the cloud.
• Handing an unlocked device still signed into accounts to a repair shop.

Understand Activation Lock; do not only turn it off

Apple’s Activation Lock and Android’s Factory Reset Protection are for when a device is reset without your permission. For a sale you must sign out yourself so the buyer is not stuck. For a theft that lock works in your favor, and you should not have turned it off earlier without a reason.

1. Sale and donation: sign out and do a full reset with your own passcode.
2. Loss: from another account put the device in Lost Mode or erase it remotely, and do not remove the lock on purpose.
3. If a buyer says the device is locked to your account, remove that device from your own account; do not send them the account password.

Delete that device’s cloud backup

1. On iPhone go to Settings, your name, iCloud, Manage Account Storage or Backups, and delete that device’s backup after you are sure you have a copy you want to keep.
2. On Android look at Google backup in System settings or the Google account.
3. Find a WhatsApp backup on Google Drive or iCloud in chat settings and in the cloud itself. Deleting the app does not always remove the cloud backup.
4. On Windows, if you used Microsoft account backup, review cloud copies in the account.
5. Wait until the “Recently deleted” period ends, or empty that folder by hand; otherwise the file can be restored for several more weeks.

If a full reset is not in play

Sometimes only a few files need to leave a computer you are keeping. A full reset is not always possible or desirable.

1. Delete the file, empty the trash, and if it is highly sensitive keep that disk encrypted so leftovers are useless without the key.
2. On iPhone empty the Recently Deleted and Hidden albums.
3. In Google Photos or Photos, open and empty recently deleted items.
4. Use a mail search for old attachments and empty the mail trash too.
5. This path is not as strong as resetting a device you will sell; prefer the reset when you are handing the device over.

Linux and Chromebook

1. If the system was installed with disk encryption, a reinstall that wipes the partitions leaves leftovers useless without the old key.
2. Encrypt or retire a disk that was never encrypted before you hand it over.
3. On a Chromebook run the official Reset or Powerwash from Settings and sign out of the Google account.
4. Check a second disk inside or attached to the device separately.

Watches, headphones and car Bluetooth

1. Unpair a watch and headphones so they do not stay tied to the account and to your next phone.
2. Clear the Bluetooth device list in a car or audio system if your number or name is there.
3. Review payment cards stored on a watch or in a wallet inside your account.

A handover list, from start to finish

1. Back up and test a restore.
2. Put keys and recovery codes aside.
3. Remove the SIM and memory card.
4. Unpair the watch and accessories.
5. Confirm encryption.
6. Sign out of the main account and run the official reset through to the initial screen.
7. From another device, check that account for the device and its cloud backup.
8. Wipe or keep accompanying flash drives and disks separately.
9. Remove paper and stickers on the device that show a name and phone number.

How to tell the wipe is finished

1. The device should have reached first-time setup, as on day one, and should not unlock to the desktop with your old password.
2. Your Apple or Google account should not be required for the buyer to set the device up.
3. If it still joins the home Wi-Fi automatically, or your name is on the lock screen, the work is not finished.

Embedded SIMs and a second disk

1. Before you erase an iPhone, see whether it asks if the eSIM should stay. For a sale or donation do not leave it on the device; the mobile plan should remain yours.
2. On Android, delete or transfer the eSIM from network settings as well.
3. A Windows reset usually targets only the system drive. If you have a second disk or a data partition, encrypt and wipe it separately, or remove it and decide separately.
4. Do the same for extra Mac storage or a dock that holds an external disk.

A work profile and a secure folder

1. If the phone has a work profile, remove it through the official work path or from work-account settings before handover, so organization data does not stay on a personal device you are selling, or the reverse.
2. A secure folder or private space on some Android phones holds separate data; back up anything there that should remain before the reset, and know that the reset removes it too.
3. On Windows remove Access work or school from Accounts settings.

A device that will not turn on, or that sat in a drawer

1. Old phones and laptops in a drawer still hold that data. If they were encrypted and will not power on, the risk for the next person is lower, but recovery is hard for you too.
2. If a device was never encrypted and will not power on, treat it as a part with readable data and do not pass it to a parts buyer.
3. On an Android phone that powers on but will not boot the system, an official-manufacturer recovery reset may be possible; the Google account lock may remain.
4. Review several old devices in one pass with this same list, not only the one you are selling today.

A shared home computer

1. Deleting one Windows or Mac user does not completely destroy other users’ files, and sometimes leftover copies on the disk remain.
2. When handing over the whole device, prefer a full reset to deleting one account.
3. If the device is staying and only one person is leaving, move their files by agreement, delete their account, and know this is not as strong as a reset for sale.

When digital sanitization is not possible

A damaged disk, a drowned phone and a part that was never encrypted and will no longer power on cannot be sold with a clear conscience. For sensitive data, retiring that part is more sensible than sending it into a repair and parts chain. Label it so it does not slip back into “maybe we can fix it and sell it.”

Signing out of the account is not enough

Some buyers or trade-in shops say “just sign out, that is enough.” Signing out does not erase leftover files on the disk. Someone who later reaches those files may see photos, downloaded mail and documents.

1. Before you hand the device to a trade-in shop, run the reset yourself through to the initial screen.
2. If a staff member says they will wipe it, either stay until it finishes or have wiped it already.
3. Do not sell a device with Windows reset set to Keep my files; that option is for refreshing a system you are keeping.
4. On Windows, whether you reinstall from the cloud or from this device, both reach initial setup after Remove everything; what matters is the complete removal.

Shared albums and shared folders

1. Check a shared photo album in iCloud or Google Photos; resetting the phone does not necessarily delete that album for other people or in the cloud.
2. A shared folder you own still lives in your account after you hand over the device; delete it separately if it should go.
3. Turn off a public sharing link for a file.

Right after you hand it over

1. From another device, sign into the main accounts and look at sessions and the device list that same day.
2. If the reset was interrupted, a session may still remain; close it, and change the password if you are unsure.
3. Find My should not show you the sold device’s location; if it does, remove it from the account list—after you are sure the data is gone and you are not locking the buyer with Activation Lock.

Treat a backup disk like the device itself

1. If a Time Machine disk or a Windows backup should no longer hold data, erase it in Disk Utility or the equivalent.
2. If you want to keep the backup, leave that disk encrypted in a safe place, not in the sale box.
3. Do not forget a backup copy on an old flash drive; that one archive file can bring everything back.

What a reset does not remove

• Photos and files on a cloud account, until you delete them in the cloud yourself.
• An app session on another computer or tablet that is still signed in.
• A memory card and a flash drive that were not in the device, or were not selected during the reset.
• A computer’s second disk.
• Messages that already reached other people.
• Contacts stored on the SIM itself, if you did not remove the SIM.
• Paper and stickers on the device or in the box.

Before handover, take out the SIM, and if a contact lived only on the SIM, move or delete it separately in your own account. A remote wipe helps for the copy on a lost device; you still have to look at cloud copies separately.

Remote erase

1. If the device is lost and still on, use Find My or Google or Microsoft find-my-device to erase it remotely.
2. That does not replace closing account sessions from another device.
3. After a remote erase, review that device’s cloud backup separately.
4. A remote erase is not a substitute for a local reset you watch with your own eyes when you are selling on purpose; for a sale, the local path through to the initial screen is clearer.

What to do today

1. See whether encryption is on for devices you might sell or donate.
2. Have a tested backup off that device.
3. Find the official reset path for that operating system once, so you are not lost on handover day.
4. Review cloud recently-deleted folders and the gallery for sensitive files.
5. Collect flash drives from the desk and encrypt or retire them if they hold sensitive data.
6. If you enter an Apple ID or Google password in a shop on handover day, cover the screen from a side view, and later change that password if you have any doubt.
7. The same day after handover, open the account’s device list and confirm the sold item.

If the sold item still appears as an active device, or a new sign-in notice arrives, close the session and change the account password; the reset may not have finished. In that case coordinate with the buyer to complete the wipe on the device itself, and do not send them the account password. If you no longer have access to the device itself, run a remote erase from inside your account and then close all open sessions of that account in mail, the store and cloud storage. Do this check on the same day you hand the device over, not a few days later or in the following week.