How to Wipe Your Phone or Laptop Before Selling It

A factory reset is the lowest level of erasure the US government standard recognizes, and the gap matters the moment the device leaves your hands.

State of Surveillance

TL;DR: A factory reset is the lowest of the three levels of data erasure the National Institute of Standards and Technology recognizes, and the gap matters the moment the device leaves your hands. Microsoft's own reset documentation says the feature "is targeted at consumers and does not meet government and industry data erasure standards."[2] On flash storage, overwriting the drive can leave readable data behind, because the disk holds spare cells the operating system cannot address directly.[1] Two decisions fix this. First, turn on full-disk encryption before you erase, because encryption is what makes the erase fast and complete. Second, use the erase command that destroys the encryption key instead of the one that just deletes the files. On an iPhone, "Erase All Content and Settings" does the second thing, and Apple's security guide explains the mechanism: "Erasing the key in this manner renders all files cryptographically inaccessible."[3] On a Mac, FileVault plus deleting the volume does it. On Windows, "Remove everything" with "Clean data" checked is the closest consumer option, and Microsoft's page tells you exactly how far that goes.[2] If the drive was never encrypted, none of this reaches the old data, and the only answer left is physical destruction.

What Wiping Actually Means: The Three Levels NIST Defines

The reference document is NIST Special Publication 800-88 Revision 2, "Guidelines for Media Sanitization", written by Ramaswamy Chandramouli of NIST and Eric Hibbard of Samsung Semiconductor and released in September 2025.[1] Its abstract sets the bar: "Media sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort."[1] The guide then splits sanitization into three methods, and the differences between them matter far more than the labels suggest.

Clear is the tier a factory reset lands in. NIST's definition: "This method applies logical techniques to sanitize data in all user-addressable storage locations of an ISM for protection against simple, non-invasive data recovery techniques using the same interface that is available to the user (e.g., host interface)."[1] In plain terms, clear is a delete or a rewrite performed through the ordinary controls of the device. It stops the next person from browsing your files. It was never designed to stop a recovery attempt.

Purge is the tier you want for a device leaving your hands: "Purge sanitization techniques apply physical or logical techniques that make the recovery of target data infeasible using state-of-the-art laboratory techniques but preserves the ISM in a potentially reusable state."[1] NIST is direct about which one to reach for: "When possible, the purge sanitization method should be used instead of the clear sanitization method."[1]

Destroy is the end of the road: "Destroy sanitization techniques render target data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the ISM for the storage of data."[1] The drive is finished. Shredded, melted, incinerated. NIST groups these media under the term "information storage media", which covers hard disk drives, solid state drives, phones, mobile computing devices and office equipment, plus the "virtual" or "logical" storage that abstracts the underlying media, such as cloud storage.[1]

A factory reset is a clear. That is not a criticism of the reset, it is what the reset is defined to be: an operation carried out through the ordinary interface of the device you are holding. The gap between clear and purge is the whole subject of this article.

Why Overwriting an SSD Does Not Work the Way It Did in 2006

The old advice was to overwrite the disk several times with binary patterns. NIST documents the practice and its expiration: the Department of Defense manual 5220.22 and the NISPOM used to require it, "The number of passes ranged from a single pass to as high as 39", and "In 2006, DoD removed overwriting specifications from NISPOM."[1]

Then flash storage arrived and the technique stopped applying. NIST is blunt about it: "For certain ISM (e.g., SSDs with overprovisioning), such practices should be avoided as very little confidentiality protection is achieved."[1] The reason is physical. "Flash memory-based storage devices that contain spare cells and perform wear levelling make it infeasible for a user to sanitize all previous data using this approach because the device can not support directly addressing all areas in which sensitive data has been stored using the native read and write interface."[1] A solid state drive reserves extra capacity for its own housekeeping. The operating system cannot write to those cells. Any old data still sitting in them is invisible to a wipe and untouched by it.

Two more pieces of folk wisdom die here. The magnet does not work on a flash drive: "Degaussing should not be used for non-magnetic ISM (e.g., flash storage, such as SSDs)".[1] The same document adds that "a sanitization operation that degausses an SSD can complete successfully, but no sensitive data is sanitized."[1] Nor does drilling a hole in the drive finish the job. NIST on destructive techniques: "Techniques like bending, cutting, or some emergency procedures (e.g., shooting or drilling a hole through a storage device) may only partly damage the ISM, leaving portions of it accessible using state-of-the-art laboratory techniques."[1]

The correct route on flash is a command that talks to the drive's own controller: "Alternatively, the ISM may support dedicated sanitize commands that address all storage areas more effectively."[1] NIST flags the catch: "The use of such commands results in a trade-off because they require trust and assurance from the ISM vendor that the commands have been implemented as expected."[1] There is a faster and stronger option than any of these, and it is not a drive command at all. It is deleting the key.

The Best Wipe Is Key Destruction

NIST calls this cryptographic erase, and it counts as a purge technique. The mechanism is simple: "CE is based on the sanitization of keys used to encrypt data or to prevent access to the keys that encrypt data."[1] The data does not have to be rewritten. The key that makes it readable gets destroyed, and what is left on the disk is noise.

Here is the precondition that decides everything, and NIST states it without hedging. By way of ISO/IEC 27040, no sensitive data may previously have been stored on the media in plaintext form, because "CE can only sanitize keys related to encrypted data."[1]

Translation: cryptographic erase can only protect the data that was encrypted. A drive that was never encrypted has no key to destroy, so wiping it is just a clear with extra steps. The order of operations therefore matters more than the choice of wipe. Encrypt first, wipe second. Data you deleted while the drive sat unencrypted was never protected, and forensic tools are built to recover exactly that.

Phones: The Modern Erase Already Does This

Good news: the phone in your pocket already has the machinery. Apple's security guide describes what "Erase All Content and Settings" actually does on an iPhone: "All file metadata is encrypted with a random value key, created when the operating system is first installed or when the user completes Erase All Content and Settings."[3] And: "The key-wrapping key changes every time a user erases their device."[3] The result is the sentence that matters: "Erasing the key in this manner renders all files cryptographically inaccessible."[3] That is NIST's purge tier, and NIST says cryptographic erase lets sanitization be done "much faster than with other sanitization techniques."[1] The same document notes the erase can also be triggered from a distance "by a user or administrator issuing a remote wipe command from a device management service, Microsoft Exchange ActiveSync, or iCloud".[3]

There is a catch, and it is your passcode. Apple describes the class keys that protect your files: "The class key is protected with a key derived from the user passcode or password and the device UID."[4] The wipe is only as strong as the passcode you set on the device you are about to sell. Set a real one before you erase. The same document adds that shortly after you lock a device, "the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again".[4]

Apple's own consumer steps, in the order Apple's support page gives them:[6]

  1. Create a backup, transfer the information to your new device, and check Parts and Service History for a Finish Repair message.
  2. Unpair your Apple Watch, and cancel or transfer any AppleCare plan.
  3. Sign out of iCloud, iTunes, or the App Store.
  4. If you are moving to a non-Apple phone, deregister iMessage.
  5. In Settings, tap General, then Transfer or Reset, then "Erase All Content and Settings", then confirm with Erase.
  6. Remove your old device from your list of trusted devices.
  7. If the device uses eSIM: "If you sell a device that uses eSIM, choose the option to erase the device and the eSIM profile when asked whether to erase the device and the eSIM profile."[6]
  8. "Change your Apple Account password and turn on two-factor authentication. These actions won't remove personal information stored on your old device, but changing your password prevents the new owner from deleting your information from iCloud."[6]

That last step is a separate threat and deserves its own line of attention. The buyer cannot read your iCloud data, but without a password change the buyer can delete it. Apple's guide also notes that the erase releases the device from Apple's own locks: "When you erase your iPhone or iPad, Find My [device] and Activation Lock turn off."[6]

The regulator's version is simpler, and it predates all of the above. The Federal Trade Commission's consumer guidance, published in July 2022, lays out three steps for a phone: "Back Up Your Phone", "Remove SIM and SD cards", and "Erase Your Personal Information".[7] The SIM step is the one people skip, and the FTC spells out why: "If your phone has a SIM card, it may store your personal information."[7]

Android: Google's Reset, and the 24-Hour Wait

Google's support page for resetting an Android device to factory settings is blunt about the outcome: "A factory reset erases all your data from your phone."[8] Its preparation steps are worth reading closely if the phone is going to someone else:[8]

  • Find the Google Account on the phone and make sure you know the password.
  • "If you recently reset your Google Account password, wait 24 hours before you perform a factory reset."[8]
  • Back up your data to your Google Account first, because "all apps and their data will be uninstalled."[8]
  • Charge the phone to at least 70% and connect it to Wi-Fi or a mobile network, because you have to sign in to your Google Account after the reset.
  • A factory reset "can take up to an hour."[8]
  • For devices with Android 15 and up, you get a reminder to back up transit cards with funds on them before the reset.

On the encryption question, Google's own developer documentation says "Android 7.0 and later supports file-based encryption" and that "File-based encryption allows different files to be encrypted with different keys that can be unlocked independently."[9] The same page is explicit about the other method: "Full-disk encryption is not allowed on new devices running Android 10 and higher. For new devices, use file-based encryption."[9]

Then the honest caveat. Google's consumer documentation does not describe which sanitization method the reset actually uses, so the promise that "A factory reset erases all your data from your phone"[8] is not a statement about what a recovery lab could pull off the chip. Apply NIST's clear definition and you get the true guarantee: it protects against "simple, non-invasive data recovery techniques using the same interface that is available to the user."[1] If you need to be above that line, the only route left is physical destruction of the storage.

Laptops: Where Most People Get It Wrong

Windows. Microsoft's reset documentation has a table of options, and one honest footnote.[2] "Keep my files" reinstalls Windows and keeps your personal files. "Remove everything" reinstalls Windows and removes all your personal files, apps, and settings, and is described as "ideal for a fresh start or when you are giving away or selling your PC."[2] Inside that option sits a checkbox with a warning label attached: "Clean data: when enabled, it removes files and cleans the drive. If you're planning to donate, recycle, or sell your PC, use this option."[2] Then the footnote that tells you where the ceiling is: "The data erasure functionality is targeted at consumers and does not meet government and industry data erasure standards."[2]

The path is Settings, then System, then Recovery, then Reset PC under Recovery options.[2] Two details matter when the machine is going to a stranger. First, "Remove everything" without "Clean data" checked leaves the files recoverable, so check the box. Second, encryption changes the whole shape of the problem: "If your device is encrypted, make sure you have your BitLocker recovery key."[2] With BitLocker on and the recovery key lost, the next owner gets a drive nobody can read, including you.

Let the reset finish, too. Microsoft's page warns that the screen "might go black for a long period of time (occasionally upwards of 15 minutes)" and that "Manually attempting to restart the device yourself during this process could cause the reset to fail."[2]

Mac. Apple's documentation on FileVault is the clearest statement of this entire problem, and it contains a warning that catches most people out.[5] The mechanism first: "FileVault uses the AES-XTS data encryption algorithm to protect full volumes on internal and removable storage devices."[5] The consequence: "Without valid login credentials or a cryptographic recovery key, the internal APFS volumes remain encrypted and are protected from unauthorized access even if the physical storage device is removed and connected to another computer."[5] And the deletion step: "When deleting a volume, its volume encryption key is securely deleted by the Secure Enclave."[5]

So a Mac with FileVault turned on gives you a genuine cryptographic erase: erase the volume, the key goes with it, and the disk is unreadable even if somebody pulls it out of the machine. The trap is in what FileVault does not retroactively cover: "Data that was added and then deleted before turning on FileVault isn't encrypted and may be recoverable with forensic data recovery tools."[5] Read that again with a year of use in mind. On a Mac that was never encrypted, the files you deleted last month may still be sitting on the disk in the clear, recoverable with the same tools a laptop recycler would use. Turn FileVault on before you sell, and let it finish, or understand that you are relying on a clear.

The Copies That Are Not on the Device

Erasing the device does not touch your cloud. Apple's own support page says so plainly: "Your content won't delete from iCloud when you erase your device."[6] The same is true of the photo library and the documents you synced to a cloud account. Those copies are not on the device, so nothing you do to the device reaches them.

NIST explains why this is not a problem you can solve at the device level: "Typically, the underlying physical ISM is abstracted such that the data owner has no direct access to the physical ISM, and sanitizing them is not possible."[1] The guide adds that "For an ISM that takes the form of logical/virtual storage (e.g., cloud storage), cryptographic erase may be the only viable purge sanitization technique option."[1] You do not own the disk. The best you can do is use the deletion controls the provider gives you, and then stop syncing.

The Order That Actually Works

  1. Back up first. Apple's first step is to "Create a backup."[6] The FTC's first step is "Back Up Your Phone".[7] Google is blunt about what survives a reset: "While data stored in your Google Account can be restored, all apps and their data will be uninstalled."[8] Check your authenticator app and your password manager too, because their stored codes do not come back with the backup.
  2. Turn on encryption before you erase, not after. FileVault on the Mac, BitLocker on Windows, and on a phone make sure the screen lock and passcode are set. This is the single step that turns a clear into a purge, and it only works if the data was encrypted while you had it.
  3. Pull the SIM and the memory card. The FTC notes that a SIM "may store your personal information."[7] On an eSIM, pick the option that erases the eSIM profile.[6]
  4. Sign out of the accounts and remove the device from your trusted devices. Deregister iMessage if you are moving to a non-Apple phone.[6]
  5. Use the strongest erase the device offers. iPhone: Erase All Content and Settings. Mac: erase the volume. Windows: Remove everything with Clean data checked. Android: factory reset.
  6. Change the Apple Account password and turn on two-factor authentication. The erase turns off Activation Lock, so without the password change the new owner can delete your iCloud data. Apple's own advice is that "changing your password prevents the new owner from deleting your information from iCloud."[6]
  7. Handle the cloud copies separately. Wiping the device did nothing about them.
  8. Let it finish, then check the result. NIST on verification: "The sanitization results should be inspected to verify that the sanitization technique was completed successfully."[1] For non-destructive methods, "verification can be more complex and typically depends on the type of ISM. Clear and logical purge sanitization techniques that involve tools and systems can be verified by checking the completion status of the tools and identifying errors, anomalies, and the health of the ISM."[1] In practice that means not touching the device until the reset reports it finished.
  9. If you cannot be sure, destroy it. NIST lists the destroy methods: disintegrate, incinerate, melt, pulverize, shred.[1] It also warns that "Pulverize and shred techniques for ISM should be avoided for anything but the lowest security categories of data."[1] For a personal laptop with your tax returns on it, a shredder is the lowest category on the scale. For a work machine you were not allowed to take home, it is not.

The Honest Takeaway

Two questions decide whether your old device is actually empty. Was the data encrypted? And did you use the erase that destroys the key rather than the one that just deletes the files?

If both answers are yes, the wipe took minutes and the drive is worth nothing to whoever picks it up. If the first answer is no, nothing in the settings menu will ever reach the old data, and the only answer left is to destroy the drive. That is also why the passcode you set the day you bought the device decides how private the day you sell it turns out to be.

And remember that the device is only part of what you are handing over. The photos in your cloud account outlive the phone by years.

Sources

  1. NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)
  2. Microsoft Support, Reset your PC (Windows 11 and Windows 10 reset options, Clean data, BitLocker recovery key)
  3. Apple Platform Security, Data Protection in Apple devices (Erase All Content and Settings, key wrapping, remote wipe)
  4. Apple Platform Security, Data protection classes (class keys, passcode and device UID, decrypted class key discarded)
  5. Apple Platform Security, Volume encryption with FileVault in macOS (AES-XTS, APFS volumes, volume key deleted by the Secure Enclave)
  6. Apple Support, What to do before you sell, give away, or trade in your iPhone or iPad
  7. Federal Trade Commission, How To Remove Your Personal Information Before You Get Rid of Your Phone (July 2022)
  8. Google Android Help, Reset your Android device to factory settings
  9. Google, Android Security and Privacy: Encryption (file-based encryption, full-disk encryption on Android 10 and later)

Published: October 29, 2026