This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/technology/2014/jul/11/factory-wipe-on-android-phones-left-naked-selfie-photos-and-worse-researchers-find

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
'Factory wipe' on Android phones left naked selfie photos and worse, researchers find 'Factory wipe' on Android phones left naked selfies and worse, study finds
(about 2 hours later)
Hundreds of naked selfies and intimate pictures of both men and women were found on a batch Android smartphones that their owners thought they had wiped, a research study has found.Hundreds of naked selfies and intimate pictures of both men and women were found on a batch Android smartphones that their owners thought they had wiped, a research study has found.
After studying 20 handsets, security company Avast has warned that the "factory reset" function on Android phones doesn't actually delete data on the phone, which can be retrieved using standard forensic security tools.After studying 20 handsets, security company Avast has warned that the "factory reset" function on Android phones doesn't actually delete data on the phone, which can be retrieved using standard forensic security tools.
In all, the researches said that they found more than 40,000 photos, including 750 photos of women "in various stages of undress" and 250 photos of male anatomy. The EXIF data included in the picture file could also allow someone to find out details of the person's residence if it included location. Four of the phones included the previous owners' identity in the file data.In all, the researches said that they found more than 40,000 photos, including 750 photos of women "in various stages of undress" and 250 photos of male anatomy. The EXIF data included in the picture file could also allow someone to find out details of the person's residence if it included location. Four of the phones included the previous owners' identity in the file data.
The problem arises because the factory reset function, found in the Settings function, doesn't actually wipe the data from the storage on the phone. Instead, it wipes the index that points to the locations in the storage where the data is written. Normally, that is sufficient to prevent someone who acquires the phone from accessing any of that data.The problem arises because the factory reset function, found in the Settings function, doesn't actually wipe the data from the storage on the phone. Instead, it wipes the index that points to the locations in the storage where the data is written. Normally, that is sufficient to prevent someone who acquires the phone from accessing any of that data.
But by using forensic tools that directly access the storage areas, Avast was able to reconstruct the files - and make its disconcerting discovery.But by using forensic tools that directly access the storage areas, Avast was able to reconstruct the files - and make its disconcerting discovery.
Google told Ars Technica that the research "looks to be based on older devices and versions [of Android] and does not reflect the security protections in Android versions that are used by 85% of users." That suggests that only versions running software before Android 4.0 are vulnerable in this way.Google told Ars Technica that the research "looks to be based on older devices and versions [of Android] and does not reflect the security protections in Android versions that are used by 85% of users." That suggests that only versions running software before Android 4.0 are vulnerable in this way.
However, Google's Android documentation shows that setting file encryption is optional - which leaves newer devices vulnerable too.However, Google's Android documentation shows that setting file encryption is optional - which leaves newer devices vulnerable too.
Android 3.0 onwards has offered a setting which will encrypt the phone, using a cryptographic key generated from a user-provided passcode. If that is done, then a "factory reset" will delete the key, rendering the data unreadable. Google's spokesperson recommended that people who are disposing of a device should enable encryption, and then carry out a factory reset.Android 3.0 onwards has offered a setting which will encrypt the phone, using a cryptographic key generated from a user-provided passcode. If that is done, then a "factory reset" will delete the key, rendering the data unreadable. Google's spokesperson recommended that people who are disposing of a device should enable encryption, and then carry out a factory reset.
Apple's iPhones and iPads encrypt their data using the AES 256 algorithm, with a software key that is generated using information from the user. When the owner chooses to "erase all content and settings" to wipe an iPhone or iPad, the cryptographic key is deleted - meaning that although the data remains on the phone, it is encrypted beyond any capability to decode it.Apple's iPhones and iPads encrypt their data using the AES 256 algorithm, with a software key that is generated using information from the user. When the owner chooses to "erase all content and settings" to wipe an iPhone or iPad, the cryptographic key is deleted - meaning that although the data remains on the phone, it is encrypted beyond any capability to decode it.
For older devices dating back to 2008, such as the original iPhone and iPhone 3G, or first two versions of the iPod Touch, erasing the device writes a series of 1s over the existing data partition.For older devices dating back to 2008, such as the original iPhone and iPhone 3G, or first two versions of the iPod Touch, erasing the device writes a series of 1s over the existing data partition.
• Flying soon? How to extend your Android phone or iPhone's battery life• Flying soon? How to extend your Android phone or iPhone's battery life