You’ve factory reset your old phone. Your photos have disappeared, your messages are gone and the welcome screen looks exactly as it did when the handset was new. But could someone who buys that phone recover your personal information?
It’s a reasonable question, especially when your phone has spent years storing family photographs, banking information, saved passwords, emails and private conversations.
The reassuring answer is that a proper factory reset usually provides effective data erasure on a modern iPhone or Android phone. However, there are important exceptions. Some older devices offer weaker protection, cloud backups remain separate from the phone, and a failed reset can leave information behind.
In fact, the UK’s National Cyber Security Centre (NCSC) recommends using the manufacturer’s full erase or factory-reset function before selling or giving away a smartphone.
This guide explains what actually happens to your photos after a factory reset, how to wipe an iPhone or Samsung Galaxy safely and what to do before handing your old phone to someone else.
We’ll also look at why professional phone recyclers use certificated data-erasure tools such as MobiWIPE when they process devices for customers and businesses.
Quick answer: Can someone recover photos after a factory reset?
On a modern, properly encrypted iPhone or Android phone, a completed factory reset generally makes the previous user’s locally stored photos and other personal data inaccessible. However, the exact level of protection depends on the device, its encryption and whether the reset completed correctly.
A factory reset also does not automatically delete cloud backups, erase removable memory cards or remove copies stored elsewhere. Therefore, check those separately before you sell, recycle or give away your phone.
What happens to your photos when you factory reset a phone?
A factory reset returns the phone to its initial setup state and removes the previous user’s locally stored data through the device manufacturer’s erase process.
That typically includes photographs, downloaded applications, messages, contacts and locally stored account information.
However, deleting a photo individually and resetting the entire handset are not the same thing.
Deleting photos is different from erasing your phone
When you delete a photograph from a phone, the operating system may move it into a Recently Deleted folder or remove its normal file reference.
Depending on the device and storage system, underlying information may remain until the system removes or overwrites it.
Consequently, manually deleting individual photographs is not the recommended preparation for selling a handset.
A complete factory reset follows the manufacturer’s device-erasure procedure instead.
The NCSC recommends this approach for ordinary smartphone resale and explains that simply deleting files does not provide the same protection.
Why encryption makes a difference
Modern smartphones use encryption to protect information stored on the device.
Encryption converts readable information into protected data that requires the relevant cryptographic keys to access.
On devices that support an appropriate cryptographic erase, removing those keys can make the previous data inaccessible without physically overwriting every photograph.
However, not every phone uses the same security architecture. Older devices, damaged storage and incorrectly completed erasure processes can create additional uncertainty.
Therefore, always follow the manufacturer’s current instructions for your specific model.
Can photos be recovered after an iPhone factory reset?
For a modern iPhone that completes Apple’s official Erase All Content and Settings process, the previous user’s locally stored information should no longer be accessible through normal use.
Apple explains that the erase procedure removes personal content and settings from the handset.
Furthermore, when you erase the iPhone properly, the process also turns off Find My and Activation Lock.
However, your iCloud account and any photos stored there remain separate.
That distinction matters because a person may assume the original pictures still exist on the phone when they actually remain available through an authorised cloud backup.
Does factory resetting an iPhone delete iCloud photos?
No. A normal device erase does not delete your content from iCloud.
For example, suppose you take 5,000 photographs on an iPhone and synchronise them with iCloud Photos.
You then erase the handset before selling it.
The photographs disappear from the old phone, but they can remain in your iCloud library. You can access them again by signing into your Apple Account on another compatible device.
Importantly, the new owner should not gain access to your iCloud photographs simply by purchasing your correctly erased phone.
However, you still need to remove your account connection and complete the erase process properly.
Apple explains the complete process in its guide to selling, giving away or trading in an iPhone.
Can someone use recovery software after an iPhone reset?
Recovery software can sometimes help people recover recently deleted files or information from accessible backups.
However, recovering a photograph from a backup is very different from extracting previous user data from a properly erased, encrypted iPhone.
A completed manufacturer erase on a modern device provides significantly stronger protection than deleting photos individually.
Nevertheless, no responsible security provider should promise that every possible device, software configuration and forensic scenario has exactly the same risk.
How to factory reset an iPhone before selling it
If you’re selling your iPhone, follow Apple’s full preparation procedure rather than simply deleting the Photos app or individual files.
Step 1: Back up your information
First, save the photographs, messages, documents and other information you want to keep.
You can use iCloud or another supported backup or transfer method.
In addition, check that you can access the information from your new device before erasing the old one.
Step 2: Transfer important account access
Next, make sure you can still receive login verification codes and access important accounts.
For example, you may use the old phone for banking approvals or two-factor authentication.
Therefore, move those functions to the new handset before you erase the original device.
Step 3: Unpair your Apple Watch
If you use an Apple Watch with the iPhone, unpair it according to Apple’s instructions.
This helps prevent unnecessary connection or setup problems later.
Step 4: Sign out of your Apple Account
Open Settings and follow the relevant Apple Account sign-out instructions for your iOS version.
On iOS 26 and later, Apple provides updated options in the sign-out flow, including an Erase this Device choice.
Because menus differ between iOS versions, follow Apple’s current instructions rather than relying on an old screenshot.
Step 5: Erase all content and settings
Go to:
Then follow the on-screen prompts and enter the requested credentials or passcode.
If the phone contains an eSIM, choose the appropriate option to remove the eSIM profile when selling the handset.
Finally, allow the process to complete.
Step 6: Check the welcome screen
Once the erase process finishes, the iPhone should return to its initial setup screen.
Do not sign back into your account.
Instead, check that the phone is ready for a new owner to complete their own setup.
For further guidance, see Apple’s official selling and trade-in checklist.
Can photos be recovered after a Samsung factory reset?
Samsung Galaxy phones use Android-based software and built-in factory-reset functionality.
On supported modern devices, a properly completed factory reset removes the previous user’s locally stored information.
However, the result depends on the device model, software and storage configuration.
For example, a phone may contain removable microSD storage that requires separate attention.
Likewise, photographs backed up to Google Photos or another cloud service can remain accessible through the original account.
Does a Samsung factory reset delete Google Photos?
A factory reset removes local information from the handset. However, it does not automatically delete photographs stored in your Google Photos cloud account.
Therefore, you can often recover your photographs by signing into the same Google Account on another device, provided those photographs were backed up.
Google explains how photo backup works in its Google Photos backup guidance.
Before resetting, check which photographs have successfully reached your account.
Remember that seeing a photograph inside the Google Photos app does not necessarily mean the cloud has backed it up.
What about photos on a microSD card?
A removable memory card is a separate storage device.
As a result, you should not assume that resetting the phone has erased every photograph or document on the card.
Remove the card before selling or recycling the phone.
If you intend to transfer the card to another person, review the appropriate secure-erasure method for that storage media.
The NCSC publishes separate guidance on secure sanitisation of storage media, including removable flash storage.
How to factory reset a Samsung Galaxy before selling it
Samsung recommends backing up important information and removing the relevant accounts before resetting a handset that you plan to give to someone else.
Step 1: Back up your files
Start by saving photographs, contacts, messages and anything else you want to keep.
Depending on the model, you can use supported Samsung, Google or other backup and transfer tools.
In addition, move authenticator access and important recovery information to your new phone.
Step 2: Remove your Google Account
Next, open Settings and find the account-management section.
On many Galaxy devices, the route is:
Select the relevant Google Account and follow the Remove account process.
This step matters because Google’s Factory Reset Protection can require the previous account details after certain reset methods.
Samsung explains the process in its official factory-reset instructions.
Step 3: Check other account connections
Review any remaining account, management or device-protection settings that could affect the next owner’s ability to use the phone.
For example, a company-managed device may require action from the organisation’s IT administrator.
Furthermore, remove your physical SIM and any removable memory card.
Step 4: Run the factory reset
On many Samsung Galaxy devices, open:
Then follow Samsung’s on-screen instructions.
Menu labels can differ between device models and One UI versions. Therefore, check Samsung’s guide if your handset uses a different path.
Step 5: Confirm that the phone is ready for its next owner
Once the reset finishes, check that the phone starts its initial setup process.
Do not sign back into your personal account.
Also, avoid sending passwords, recovery codes or account credentials to the buyer.
How to factory reset a Google Pixel before selling
Google Pixel users can follow a similar preparation process.
First, back up important information and check account access.
Then remove account connections as appropriate and open the factory-reset settings.
Google’s official Pixel guidance gives the following route:
Google specifically recommends using the factory-reset option inside Settings when preparing a Pixel for trade-in.
For instructions tailored to your model, see Google’s Pixel factory-reset guide.
Five things a factory reset may not remove
A factory reset can work correctly and still leave information elsewhere.
Therefore, consider the following items before you send your phone to a new owner.
1. Your iCloud or Google Photos library
Cloud services store information separately from the local phone.
Consequently, resetting the handset does not automatically erase photographs stored in the relevant cloud account.
This is usually useful because it allows you to keep your memories when changing devices.
However, you should make sure the new owner cannot access your account through the old handset.
2. External memory cards
Some Android phones support removable storage.
For this reason, remove memory cards before selling or donating the handset.
Do not assume that the factory-reset procedure automatically sanitises the card.
3. Copies already shared with other people
A reset cannot recall photographs that you previously emailed, shared or uploaded elsewhere.
For example, photos you sent through messaging services may remain in other people’s conversations or backups.
Therefore, distinguish between erasing the physical phone and managing information that already exists in other locations.
4. Information stored on other devices
Your laptop, tablet and other phones may also contain copies of photographs or messages.
Similarly, synchronised services can retain data under your account.
As a result, wiping one handset does not erase every copy of the information you have created.
5. Data on a device that never completed the reset
This is one of the more important exceptions.
Suppose a phone breaks during the reset process or cannot power on.
In that situation, you cannot safely assume that its storage has completed the required erasure.
Therefore, seek appropriate specialist help before selling or disposing of a device that may still contain sensitive information.
Can someone recover data from a broken phone?
Potentially, yes.
A broken screen does not necessarily mean the internal storage has failed.
Likewise, a phone that refuses to power on may still contain data on working storage components.
The Information Commissioner’s Office (ICO) specifically warns that a device can still hold accessible information even when it no longer switches on.
Therefore, do not throw away or casually sell a faulty handset simply because you cannot see its contents.
What should you do with a phone that won’t turn on?
First, determine whether an authorised repair provider can restore enough functionality to complete the recommended erase process.
If your device uses supported remote-management functions, you may also have an option to issue a remote erase command.
However, remote erasure generally depends on the device meeting the service’s connectivity and other requirements.
For business-owned devices, an IT administrator should follow the organisation’s approved data-disposal policy.
When appropriate sanitisation cannot be verified, the organisation may need another approved disposal route.
Is a factory reset enough before recycling a phone?
For most people selling a modern, supported smartphone, the manufacturer’s completed erase process is the appropriate starting point.
In fact, the NCSC recommends these built-in functions for routine smartphone erasure.
However, businesses face additional responsibilities when they handle company devices or customer information.
For example, an employer may need to establish exactly which handset it erased, whether the process succeeded and who authorised the device’s release.
A recycler processing hundreds of devices also needs a way to identify failures.
Consequently, the difference is not simply whether a wipe function exists. It is whether the organisation can demonstrate that its overall erasure process works.
Factory reset versus professional data erasure
| Consideration | Manufacturer factory reset | Professional erasure workflow |
|---|---|---|
| Main purpose | Erase a phone for reuse or resale | Manage erasure as a repeatable business process |
| Typical user | Individual device owner | Recycler, refurbisher, ITAD provider or organisation |
| Evidence | User confirms the reset completed | Device-linked records and certificates where supported |
| Processing multiple devices | Typically requires individual handling | Can support batch or simultaneous processing |
| Failed erasure | Requires the user to notice and investigate | May provide exception alerts and reporting |
Both approaches have a legitimate role.
Therefore, a professional erasure tool should not be marketed on the misleading assumption that every normal iPhone or Android factory reset leaves recoverable personal data.
Its additional value comes from controlled processes, verification, reporting and appropriate certification.
Why professional phone recyclers need proof of data erasure
Consider a company replacing 500 employee smartphones.
Each phone may contain emails, customer records, business applications, contacts and other commercially sensitive information.
The IT team wants to reuse suitable handsets or sell them through an approved recycling provider.
However, management also needs confidence that the old information will not move with the hardware.
One erased phone is different from 500 recorded erasures
An employee can reset one handset and check that it restarts.
However, repeating that process across 500 devices creates several operational questions.
For example, which devices completed erasure? Did any fail? Who processed them? Which handsets still require investigation?
Without consistent records, management may struggle to answer those questions later.
Why a data-erasure certificate matters
A device-level erasure certificate provides evidence that the recorded processing activity took place.
It can help a business maintain an audit trail and respond to customer requests.
However, a certificate is not an unconditional guarantee that no data could ever be recovered under every possible circumstance.
Instead, its value depends on the underlying method, successful completion, device information and integrity of the recorded process.
Consequently, organisations should assess the full sanitisation procedure rather than relying on a certificate alone.
Where MobiWIPE fits into secure phone recycling
MobiWIPE is MobiCode’s professional data-erasure application for Apple and Android devices.
It helps businesses process pre-owned handsets while maintaining device-level erasure records and reporting.
Rather than relying on individual employees to reset phones and update separate spreadsheets, MobiWIPE provides a structured erasure workflow.
MobiCode positions the service for recyclers, refurbishers and organisations that manage significant volumes of mobile devices.
Certificated phone data erasure
MobiCode states that MobiWIPE generates a PDF certificate for erasure activity.
As a result, businesses can retain a record of the process and provide relevant evidence to customers.
For example, an IT asset-disposal provider may need to demonstrate which devices it processed during a corporate upgrade.
Multiple simultaneous device connections
MobiWIPE supports multiple handsets connected at the same time.
Therefore, processing teams can avoid relying entirely on sequential manual phone resets.
This becomes especially useful when organisations handle large returns, trade-in batches or scheduled device-refresh programmes.
Exception alerts
Not every phone enters the recycling workflow in perfect condition.
For instance, a handset may have an account restriction or another issue that prevents the expected process from completing.
MobiWIPE highlights exceptions so staff can investigate them instead of assuming every device passed.
Central reporting across locations
MobiCode’s reporting environment provides visibility across users and locations.
Consequently, management can monitor processing activity more consistently when several teams handle devices.
That is particularly valuable for large retailers, recyclers and organisations managing devices at multiple sites.
ADISA-approved erasure and flexible pricing
MobiCode describes MobiWIPE as an ADISA-approved application and advertises insured erasure services.
It also offers volume-based pay-as-you-go tariffs without mandatory monthly or annual commitments on its current product page.
Businesses should confirm the applicable approval scope, insurance terms, supported devices and current prices directly with MobiCode.
Processing used phones for customers?
If your business handles device trade-ins, recycling, refurbishment or corporate phone disposal, reliable erasure records matter as much as the erase process itself.
MobiWIPE combines secure mobile data erasure with device-level certification, simultaneous processing, exception handling and central reporting.
It can help your team maintain a clearer record of which handsets are ready for their next owner.
What does the latest data-erasure guidance say?
Professional data erasure is not just about selecting a software product.
Organisations also need procedures that reflect the sensitivity of the information and the equipment they handle.
Recent standards and government guidance reinforce that wider responsibility.
NIST updated its data-sanitisation standard in 2025
In September 2025, the US National Institute of Standards and Technology published NIST SP 800-88 Revision 2.
The updated standard places greater emphasis on managing sanitisation as an organisation-wide programme.
For example, organisations should select appropriate methods, maintain suitable controls and validate the results.
Therefore, the process involves more than performing isolated erasures.
The UK encourages secure technology reuse
The UK government’s IT Reuse for Good Charter guidance, updated in October 2026, encourages organisations to consider reuse before discarding suitable technology.
That includes smartphones and other IT equipment that could benefit another user.
However, organisations need appropriate data-erasure controls before releasing devices.
Consequently, secure sanitisation can help businesses recover value from working equipment without transferring the previous user’s information.
UK data-protection obligations still apply
The ICO also stresses the importance of deleting personal information appropriately when organisations dispose of equipment.
For example, a company should assess whether its sanitisation method suits the device and the sensitivity of the information it contains.
Moreover, the organisation should address unsuccessful erasures rather than treating every device as ready for release.
Professional tools can support that process, but buying software alone does not automatically establish compliance with every UK GDPR obligation.
How MobiONE can extend the recycling process
Some businesses need more than data erasure.
A mobile phone recycler may also need to check the device’s commercial status, test hardware functionality and apply a resale grade.
For example, a handset could complete data erasure but still have a defective screen or an unresolved activation-lock issue.
Therefore, a complete recycling workflow requires several checks.
Connecting checks, testing and erasure
MobiONE brings multiple device-processing functions into a broader workflow.
It can connect relevant device-status checks, diagnostics, grading, data erasure and reporting.
Consequently, businesses can reduce their reliance on disconnected processes as they move phones from acquisition to resale.
MobiWIPE provides the dedicated erasure capability, while the wider MobiCode ecosystem supports other stages of device processing.
Why this matters for customer confidence
Consumers want to know that the phone they buy works correctly.
Meanwhile, businesses and previous owners want confidence that the handset no longer contains their information.
A well-managed refurbishment process addresses both concerns.
Therefore, functional testing and data erasure complement each other rather than solving the same problem.
Before selling your old phone: final checklist
Whether you use an iPhone, Samsung Galaxy or Google Pixel, completing a few checks before dispatch can prevent serious inconvenience.
- Back up your photographs and files. Verify that you can access the information you want to keep.
- Transfer account recovery access. Move authentication apps, trusted phone numbers and other important login methods.
- Remove the relevant account connections. Follow the manufacturer’s Apple Account, Google Account or other account-removal guidance.
- Check device-management restrictions. Company-owned phones may require an IT administrator.
- Use the official factory-reset function. Avoid relying on manually deleting applications and photographs.
- Review your eSIM. Transfer or erase the relevant profile according to the manufacturer’s and network’s instructions.
- Remove physical SIM and memory cards. Keep personal removable storage unless you intend to sanitise and transfer it separately.
- Confirm the reset completed. Check that the phone returns to its initial setup state.
- Do not provide your passwords to the buyer. Use authorised account-management procedures if a problem remains.
Finally, if the phone cannot complete the reset, do not assume that the information has disappeared.
Instead, seek appropriate advice before transferring ownership.
Can someone recover your photos after a factory reset? The verdict
For most people selling a modern smartphone, a properly completed manufacturer factory reset provides effective protection for locally stored photographs and personal information.
However, cloud backups, removable storage, failed erasures and some older devices require additional attention.
Therefore, the safest approach is to back up your information, remove relevant accounts, use the official erase procedure and check that the handset is ready for a new owner.
For businesses handling devices professionally, the challenge goes further.
They need to demonstrate that the right phone completed the right erasure process and that staff investigated any failures.
That’s where professional tools such as MobiWIPE can help.
Secure mobile data erasure for your business
Do you buy, refurbish, recycle or manage used mobile devices?
MobiWIPE helps professional teams erase Apple and Android devices through a controlled workflow, generate PDF erasure certificates and monitor processing activity.
Why businesses choose MobiWIPE
- Data erasure for Apple and Android devices.
- ADISA-approved application, according to MobiCode.
- PDF erasure certificates.
- Multiple simultaneous device connections.
- Exception alerts and account-risk information.
- Central reporting across users and locations.
- Flexible volume-based PAYG tariffs.
- Integration with wider MobiCode device-processing tools.
Whether you manage a small refurbishment operation or process devices across several sites, MobiCode can help you assess the right erasure workflow for your business.
Erase the data. Record the result. Give suitable devices a second life.
Frequently asked questions about photos after a factory reset
Can someone recover deleted photos after a factory reset?
A properly completed manufacturer factory reset generally makes locally stored data inaccessible on modern encrypted smartphones. However, older devices, failed resets and separate storage can present different risks. Photos may also remain accessible through authorised cloud backups.
Does a factory reset permanently delete everything on an iPhone?
Apple’s Erase All Content and Settings process removes the handset’s personal content and settings. However, it does not automatically delete information stored in iCloud or copies held on other devices. Therefore, device erasure and cloud account management are separate tasks.
Does factory resetting a Samsung delete Google Photos?
A Samsung factory reset removes local data from the handset. However, photographs previously backed up to Google Photos can remain in the original Google Account. You can access them again by signing into that account, provided the backup completed successfully.
Can a phone shop recover my photos after I sell my phone?
A proper erase on a supported modern encrypted phone should make the previous user’s local information inaccessible through normal access. However, a faulty or incomplete reset creates uncertainty. Therefore, follow the manufacturer’s full instructions before selling the handset.
Does a factory reset erase an SD card?
Do not assume that resetting the phone will securely erase a removable SD card. Instead, remove the card before selling the handset. If you want to transfer the card, select an appropriate sanitisation method for the storage device.
What if my old phone is broken and cannot factory reset?
A broken phone may still contain accessible personal information. Where possible, seek authorised repair or secure-erasure assistance. For devices holding sensitive organisational data, follow the relevant company sanitisation and disposal policy rather than assuming the information has disappeared.
Is factory reset enough for GDPR-compliant phone disposal?
A proper manufacturer reset may provide effective erasure on a supported device. However, organisational UK GDPR obligations also involve appropriate security measures, accountability and handling of exceptions. Professional erasure workflows and records can help support these responsibilities, but no software purchase automatically guarantees compliance.
What is MobiWIPE?
MobiWIPE is MobiCode’s professional data-erasure application for Apple and Android devices. It supports simultaneous device processing, PDF erasure certificates, exception alerts and central reporting for businesses managing used or retired smartphones.
Sources and further reading
UK cybersecurity guidance
National Cyber Security Centre — Buying and Selling Second-Hand Devices
Official UK guidance on erasing personal information before selling, donating or recycling smartphones.
Guidance on manufacturer erase functions, remote erasure, device reuse and limitations.
NCSC — Secure Sanitisation and Disposal of Storage Media
Detailed guidance for organisations handling sensitive information and electronic storage media.
Official Apple and Google instructions
Apple Support — What to Do Before Selling, Giving Away or Trading In an iPhone
Apple’s instructions for backing up, signing out, removing personal information and preparing a device for a new owner.
Google — Factory Reset a Pixel Phone
Official Google instructions covering Pixel factory resets and preparation for trade-in.
Google Photos — Back Up Photos and Videos
Guidance on cloud photo backups and how to confirm whether photos have reached a Google Account.
Samsung UK — How to Perform a Factory Reset
Samsung’s official instructions for account removal, Factory Reset Protection and device erasure.
Privacy and professional data erasure
Information Commissioner’s Office — Deleting Data from Devices
Guidance on data disposal, broken devices and the limitations of different erasure methods.
NIST — SP 800-88 Revision 2, September 2025
International technical guidance covering media sanitisation, programme controls and validation.
UK Government — IT Reuse for Good Charter Guidance
UK guidance encouraging responsible reuse of suitable technology, including smartphones.
MobiCode products
Professional Apple and Android data erasure, PDF certification, simultaneous processing, exception alerts and reporting.
Wider mobile device processing, testing, grading, data erasure and workflow management.