22

I have an Android phone which I just sold on eBay. What measures should I take before posting it off to its new home? Please answer thoroughly!

Improve this question
2

6 Answers 6

Reset to default
22

As said already, factory reset for a start.

If you care about the privacy about what is on the SD card you should use a secure erase utility. Even after formatting the card you can still recover the data...

If you google for secure erase you'll find a bunch of freeware tools to do the job.

Improve this answer
1
  • Also add tracking to your postage as some buyers will say they never got the phone and then they get their money back and your out off the money.
    – user1871
    Aug 17, 2016 at 15:29
10
  1. Format (zero) your SD card.
  2. Perform a factory reset.
Improve this answer
7
  • Is Formatting enough by itself? How should I format it? How do I perform a factory reset?
    – fredley
    Jan 11, 2011 at 22:24
  • 1
    Formatting should be enough, but if you want a secure format, you could use a tool like Eraser for Windows to wipe the SD card. The factory reset depends on your phone, but it should be under Settings -> Security and privacy, or something similar.
    – Matthew Read
    Jan 11, 2011 at 22:29
  • 3
    @fredley: If you are paranoid about security, keep in mind that formatting an SD card does not actually remove the stored data; formatting is just reinitializing the file database so everything is marked empty. It is possible -- using specialized softwares -- to recover deleted data from an SD card, as long as it hasn't been overwritten. If you're really paranoid, buy a new SD card and send off the phone with that instead of yours.
    – Lie Ryan
    Jan 12, 2011 at 15:32
  • 2
    @Lie Ryan Buying a new card is completely overkill. With non-magnetic media like an SD card, you can just zero everything and the old data is unrecoverable. Hence my suggestion of Eraser (eraser.heidi.ie)
    – Matthew Read
    Jan 12, 2011 at 16:44
  • 1
    Surely, for security, you need to wipe both the SD card and internal memory?
    – Flimm
    Apr 24, 2013 at 10:23
1

Back up

Ensure you have a backup of any information on the device that is crucial to you.

There is a wide range of ways to achieve this, from "cloud" synchronization, to apps, to command line tools. For example, at least in some cases, the Cyanogenmod project recommends using the Android Debug Bridge to back up an Android device to a PC:

adb backup -apk -all -f backup.ab

You should research the options available and apply a method for backing up that meets your needs.

Protect your privacy

Based on these articles from Greenbot, ArsTechnica, Digital Trends, LifeHacker, and (ahem) Reddit, the three persistent storage devices you should remove or securely erase if present, before relinquishing an Android device to an untrusted party, to prevent that party accessing potentially sensitive data on the device, are:

  1. SIM card.

  2. External storage (e.g. an actual, removable microSD card).

  3. Internal storage (aka "Internal SD card", even though it's not really an SD card).

The SIM card and the external storage are easy to deal with: remove them from the device before handing over the device.

The internal storage is trickier. Quoting from Wyzard (CC BY-SA 3.0):

A factory reset reformats the phone's user-data partition, but it's not a "secure" wipe; it doesn't overwrite everything with zeroes. If you want to be sure everything is erased, you can encrypt the phone first (which overwrites all the data with encrypted versions of itself), then do a factory reset (which sets up a new unencrypted filesystem).

Note that a factory reset leaves the phone's system partition (the "ROM") untouched. If you've made any changes to the system partition (such as rooting), those will remain.

That's all very well if your Android phone supports encrypting the internal storage. If not, then you had better either gain shell access to the device and perform something like cd /data && cat /dev/urandom > 0, or just not relinquish your device to an untrusted party.

Improve this answer
0

You may wish to back things up in the first instance in which case I would recommend My Back Up Pro.

https://play.google.com/store/apps/details?id=com.rerware.android.MyBackupPro&hl=en

In order to perform a Factory Reset please read this small tutorial written by Oliver Hill on May 11th 2012 entitled "How to perform a factory reset on your Android phone" for Little Green Robot Publishing (who publish a monthly magazine called The Android Magazine in the UK)

http://www.littlegreenrobot.co.uk/tutorials/how-to-perform-a-factory-reset-on-your-android-phone/

People in the past have recommended to myself that when performing a Factory Reset it should be carried out twice (whether this is necessary or not i am not sure, but there is no harm in doing it.)

Improve this answer
0

If you have an HTC device and you are really worried, you can fully format the SD card, run the RUU for the stock software, and then boot in to Android, format the SD card, and factory reset once and shut off (so that the person who turns on the phone is greeted by the first-time setup). That's what I would do.

Improve this answer
0

Not mentioned by the other answers: remove Google accounts from the phone before factory resetting, if you factory reset from recovery. Google's factory reset protection (FRP) is an anti-theft measure that requires a previous Google account's password to use a phone. Removing Google accounts disables this security feature so the buyer can install new accounts without prior passwords.

If you don't remove accounts to disable FRP, you end up with this problem.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .