What is a factory reset and what does it remove?¶

A factory reset returns the handset to setup state by removing user configuration and access to local accounts, apps, settings and data; it does not erase the wider provider and cloud environment.

Modern resets commonly remove keys¶

On encrypted devices, reset usually destroys or discards keys needed for prior user data, making residual storage unreadable through ordinary methods. Exact effects vary by model, version, storage and reset method. A setup screen, reset timing, management record or account alert may remain as evidence of the event.

Investigate beyond local recovery¶

Cloud backups, app-provider events, network records, linked devices and synchronised content may survive. Compare reset timing with account activity, replacement devices and communications. Reset is common for sale, repair and troubleshooting, so timing may be relevant without proving evidence destruction.

Record a setup-state phone as found and do not proceed through configuration. Data after reset depends on specialist assessment and external sources.