Can data remain after a factory reset?¶

Possibly, but investigators should not assume that useful user data will remain recoverable.

What this means¶

On many modern mobile devices, factory reset removes access to the encryption keys that protected the previous user’s data.

Even if fragments remain physically on storage, they may be unreadable.

Older devices, removable memory cards, incomplete resets or unusual storage configurations may behave differently.

Some artefacts may survive, but recovery depends heavily on the device, operating system, encryption and reset method.

The more reliable opportunities may exist outside the handset.

Cloud backups, photographs, messages, account logs, application-provider records, network records and linked devices may still retain relevant evidence.

A reset may also leave indirect evidence.

The device may show setup activity, a new account, fresh app installations or connections beginning immediately after the reset.

Account providers may hold security alerts, trusted-device changes or backup records.

Those actions may overwrite information, create new records or complicate later interpretation.

The investigative question should remain broader than “can we recover the old files?”

The operational takeaway is: some data may remain after a reset, but modern encryption often makes local recovery limited. Preserve the handset and prioritise cloud, provider and linked-device evidence rather than relying on residual storage alone.

What to check or do next¶

• Do not power on, configure or restore a reset device merely to see what is available.
• Do not promise that deleted or reset data can be recovered.
• Ask when the reset happened, who controlled the device, what accounts were linked, what data was synchronised and what external records exist.

Evidential limits¶

That depends on specialist assessment and may not be possible.