Good News-Bad News: Evidence lives on when you wipe an Android phone

Good news for litigators — your forensic examiner can very likely recover data from an Android phone that’s been wiped using the factory reset option. Indeed, an examination of 20 wiped Android phones purchased on eBay yielded 40,000 photos and hundreds of text and email messages.

The bad news – you can’t be confident selling or giving away your own Android. The same 20-phone experiment recovered the identities of some of the previous owners. The researchers also dredged up a completed loan application containing personal financial information.

There’s additional liability if you keep client data on your phone.

This report on the Consumer Affairs website details the scope of the problem – there are more than a half billion used Android phones circulating out in the world, with previous owners’ account passwords, contacts, and other data potentially recoverable. Researchers even recovered encryption keys.

One way to be certain you’ve destroyed the data is to destroy the phone. If, however, like Habeas Hard Drive, you’d rather poke needles in your eyes than walk away from the 200 bucks your used phone will command from a willing buyer, contact a forensic expert who will wipe your phone. (For about 200 bucks. You can see the problem here).

Here’s a better idea. Reset the device, and use it as a media player. Over time, music, podcasts, and videos you download will overwrite all the other material. As a bonus, you won’t have to worry about leaving your primary phone at the gym, or dropping it on the pavement while you’re walking the dog.

Regarding quest for electronic evidence, be sure to include in your preservation letter a list of specific data you’re seeking from mobile devices, and include the names and models of the devices. Knowing that evidence might live forever in an Android phones, the decision to go forward with a forensic examination may be an easy one.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s