What the research found
A 2022 study purchased 100 second-hand mobile phones and tablets from the UK resale market and examined what data remained on each device through forensic tools. Only 52% had been reset to factory settings or had their data erased, meaning close to half showed no attempt at removal. Of the devices where data was still present, 20% held enough personal detail to identify the previous owner: names, account information, and other identifying material sitting on the device for whoever bought it next. A separate 28% of the devices purchased weren’t even functional or recognized by the forensic software used, sold as working products despite not working at all.
This isn’t an isolated finding tied to phones alone. A related 2025 study of 614 USB flash drives sold as new on the low-cost secondhand chip market found recoverable user data on more than 12% of them, meaning a drive marketed and sold as brand new could still carry a stranger’s files from a previous life as a different, used component.
Why “I did a factory reset” doesn’t guarantee what people assume
A factory reset is widely treated as a clean, complete wipe, the digital equivalent of erasing a whiteboard. Forensic research on modern Android devices pushes against that assumption, finding that some data remains recoverable through low-level analysis even after a proper reset, since not every storage partition gets reset to a blank state. Combine that technical gap with the more basic finding that about half of sellers never attempted any wipe, and the picture becomes clear: the device changing hands doesn’t mean the data on it changed hands too.
The practical takeaway
Before selling or giving away a phone, tablet, or storage device, use the manufacturer’s official data-wiping guidance rather than assuming a basic factory reset alone is enough, and for anything holding sensitive data, encrypting the device first and then performing the reset adds an extra layer, since encrypted data that can’t be decrypted is far less useful to whoever recovers it. If you’re buying a used device, don’t assume the previous owner handled this well. Doing your own factory reset right after purchase, before signing into any of your own accounts, is a reasonable habit no matter what the seller claims they already did.
Wiping standards and built-in security features have kept improving across device generations, and newer devices with strong default encryption may behave in a different way than the specific models tested in this research. The underlying pattern, real user behavior falling short of a full wipe, is the part most likely to hold across device types and time.
Reference
Angelopoulou, O., Jones, A., Horsman, G., Pourmoafi, S. “A Study of the Data Remaining on Second-Hand Mobile Devices in the UK.” Journal of Digital Forensics, Security and Law, 2022. https://doi.org/10.58940/1558-7223.1785
Schneider, J., Lautner, I., Moussa, D., Wolf, J., Scheler, N., Freiling, F., Haasnoot, J., Henseler, H., Malik, S., Morgenstern, H., Westman, M. “In Search of Lost Data: A Study of Flash Sanitization Practices.” arXiv, 2025. https://arxiv.org/abs/2505.14067
