When data is encrypted on a computer, all a factory reset does is throw away the encryption keys and within seconds your data turns into mathematical gibberish. When data is not encrypted on a computer, what happens is that your operating system simply marks the area used to store your files as “available” but your files remain exactly where they were. It is these differences that ultimately determine whether or not we can retrieve your lost data.
Modern devices (phones and Macs) encrypt their information by default. So when you do a reset, it will discard the encryption key and there’s no other step to take in this situation. However, older devices and many Windows installations are set up so they can be “reused” without actually deleting what was previously on them. This is an entirely different result.
iPhones, iPads, most modern Android phones, Mac computers with an integrated T2 chip or Apple Silicon chips, and any PC running Windows with BitLocker enabled all have their storage encrypted by default. Therefore, when you perform a “factory reset” on one of these devices, it will execute what’s referred to as a “crypto-erase”. In this process, the encryption keys used to protect your data are discarded, not the actual data itself. Although the original data remains in place on the flash memory, because there is no longer a valid decryption key available to access that information, those bytes become essentially “noise”, and no matter how much time or money you spend in a lab trying to recover them, you can’t.
This is an actual, instant and irreparable action. This is the right behaviour for this type of device (allows phones to be cleared in seconds as opposed to hours); however, when referring to these devices “does a factory reset remove everything” has one clear answer: yes.
When you do a reset or a “quick” format of an unencrypted disk, it simply formats the FAT32 (or NTFS) tables that tell the operating system how to read the data on the disk. It does not overwrite any of your files. They still exist in their original location until they are overwritten by writing new data to those locations. Many Windows computers have this issue because they don’t use BitLocker to protect the disk. Most portable storage devices such as external hard drives are also unencrypted. Older versions of Android did not encrypt all of the device’s data either. The same applies if you had to completely reinstall your computer using media rather than doing a restore or reset.
Windows has an additional wrinkle you should know about with regard to resets: “remove my files” and “fully clean the drive”. Remove my files will quickly erase your files but leaves them able to be recovered. Fully clean the drive will take several hours to completely overwrite all of the data on the drive. Because people are usually in a rush when they need to do a reset, most end up choosing remove my files. That’s good news, because it means that if someone does something wrong while resetting their computer, we can often still recover their lost files.
iPhone and iPad: erased using crypto wipe; there is no method to restore data from an encrypted device. Modern Android: most devices are also wiped (for the same reasons). Mac with T2 or Apple Silicon: destroyed. Older Intel Mac with a removable drive and no FileVault: often restorable. Windows PC without BitLocker, reset with “remove my files”: likely can be restored. Windows PC with BitLocker, or reset with “fully clean the drive”: destroyed. External hard drive quick-formatted: most of the time will be restorable. SSD where TRIM has run: unlikely to be able to restore.
Turn off the item before doing the setup process, as this will write constantly during setup. Do not place a backup on an affected drive as you will be writing over the exact area where you need to read. Also do not load recovery software onto the damaged disk.
If the data remains on the disk, the cost of one drive is from £300 +VAT after a complimentary 48-hour diagnostic (in which time we provide a written quotation), and in most cases you only pay if we recover your data. In the event of a device being crypto-erased there is nothing to recover, and we will advise you of this at the end of the diagnostic rather than take the job; there would be no ethical basis upon which we could request payment for our time.
Yes, when using an encrypted device. Devices like iPhones, modern Android phones, T2 or Apple Silicon Macs, and PCs with BitLocker enabled will use crypto-erase (the encryption keys will be destroyed and the data will become unreadable immediately). When using an unencrypted device, the computer just marks the space as reusable, and many times the data can survive.
Frequently, if BitLocker was not enabled on your computer, and you selected “remove my files” instead of selecting “fully clean the drive”. The fast erase option will rewrite your file system but leave all of your files in their original location. The full erase option will completely overwrite everything and take several hours. After completing the full wipe, no information will exist to be recovered.
Very rarely, if at all. Modern day smartphones are defaulted to encrypting. This means when resetting the phone, the encryption key is destroyed and the data cannot be read from the flash memory, even though it may still exist. However, cloud backups or a memory card are realistic ways to get lost data back.
Turn power off before completing the set-up procedure as this continually writes to the disk. Avoid restoring files on to the affected disk and installing software etc. The initial 60 minutes with respect to surviving data is always going to be far more important than what happens next.
We can provide a written quote for the recovery of your data; the cost of recovering a single failed unit is from £300 +VAT after a free 48-hour diagnostic, and in most cases you only pay if we recover your data. If your device has performed some form of crypto erase then there is no data to recover; at the time of the diagnostic we would advise you accordingly rather than charging for the privilege of discovering that fact.