Why Deleted Photos Can Come Back After You Sell Your Phone

Can a stranger see photos you deleted from a phone you sold? Sometimes, yes. Deleting a photo usually only marks its space on the phone as free. The picture stays there until something new is written over it, and a factory reset on an older or unencrypted phone may not change that. On a newer phone with encryption on, a reset destroys the key that unlocks the data, so what is left cannot be read. The safe order before you sell is: back up, sign out of your accounts, check encryption, then factory reset.

What "delete" really does

Think of your phone's storage as a book with an index at the front. When you delete a photo, the phone removes its entry from the index. The pages that hold the photo are still there. SamMobile's guide to selling a phone describes it in technical terms: the phone marks the space as available for new data, but does not immediately overwrite what was in it. The Conversation's 2014 article says the same: deleting removes the link to a file, and the original stays until it is fully overwritten.

That is why recovery is possible at all. Until new data lands on the same spot, the old photo can still be read by the right software. In the Avast test below, the researchers used free forensic tools, not anything exotic.

The Avast test, and what it showed

In 2014, the security company Avast went through used phones that their sellers had supposedly factory reset, and was able to view photos taken by the original owners. The reel puts the scale at 20 phones and more than 40,000 photos. A note on sourcing: the article we link to confirms the finding, but it does not print those two counts itself. Treat 20 and 40,000 as the figures our reel attributes to Avast, not as numbers we could confirm on that page.

The arithmetic is still worth a look. If 40,000 photos came from 20 phones, that is about 2,000 photos per phone on average. It is only an average. The sources do not say how the photos were spread across the phones.

The article also says the problem affected Android phones, and that iPhones already encrypted their storage at the time. It explains why the reset failed: on some older Android models, the factory settings option did not overwrite every bit of stored data. Its advice was to think about what the phone held before selling it, and to encrypt the device.

Why newer phones are safer: encryption and keys

On a phone with full-disk encryption, your data is stored scrambled, and a key unlocks it. Think of a locked safe. A factory reset does not empty the safe. It destroys the only key. The old data may still sit in storage, but without the key it is unreadable. No key, no data.

SamMobile's guide rates the risk of data recovery after a reset by the age of the phone:

These are one guide's ratings, not a guarantee, and "very low" is not zero. The same guide warns that a reset may not erase everything on older or unencrypted phones, and that some data can survive in system partitions or firmware areas, or if the reset does not finish properly.

A worked example: one phone, one sale

Say you delete 500 photos on 1 March to free up space, and you sell the phone on 10 March. Here is what is still true on the day of the sale.

• On the phone: the space is marked free but not wiped. On an unencrypted older phone, the photos can still be there unless a reset has dealt with them.
• In your Google Photos trash: if the photos were backed up, they stay in the trash for 30 days, according to Google's help page. 30 days after 1 March is 31 March, so on 10 March they have 21 days left. Anyone who can sign in to your account can still restore them.
• On your other devices: Google says deleting from Google Photos also deletes the same items from every device with backup turned on. So you cannot use Google Photos to clean just the phone you plan to sell.

Now compare two sellers. Someone selling a 2019 phone with encryption on, who backs up, signs out and resets, sits in the "very low" row of the table above. Someone selling a phone made before 2015 who only deletes photos from the gallery sits in the "high" row. That second case is the kind the Avast test was about.

Where a deleted photo can still be

On 30 versus 60 days: the reel gives a range of 30 to 60 days. The Google Photos page we checked says 30 days for backed-up items, and 30 days for items that were not backed up (that second rule applies to Android 11 and up). Plan on 30 days, and treat anything longer as a bonus.

Who this affects

Anyone who sells, trades in, gives away or hands down a phone. The risk is highest for older Android phones: the Avast test involved Android, and the age table puts pre-2015 phones in the high row. It also affects people who leave an SD card in the phone, and people who assume that clearing the gallery is enough.

Common mistakes

• Treating delete as erase. Deleting photos only removes them from the list. It does not overwrite them.
• Resetting before backing up. After a reset your local copies are gone. Back up first, and check the backup has what you need.
• Staying signed in. The guide says to sign out of your accounts, starting with your Google Account or Apple ID, and to remove the device from your account online.
• Skipping the encryption check. A reset on an unencrypted phone may leave data behind.
• Relying on extra tricks. Some guides suggest filling the storage with large files and resetting again. The SamMobile guide mentions this but gives no evidence that it helps, so treat it as optional at best.

What to do before you sell or give away a phone

1. Back up. Use the built-in backup, and save important files somewhere else too.
2. Sign out. Log out of your Google Account or Apple ID, then remove the phone from your account online.
3. Check encryption. Look in Settings and turn on full-device encryption if it is off.
4. Factory reset.
5. Remove the SIM and SD card. Destroy old SIMs or return them to your carrier.
6. Check the result. The phone should ask for first-time setup, with no personal data visible.

What we cannot say for certain

The Avast counts come from the reel and are not printed in the article we link to. The Google Photos period may differ from what you see, so check Google's current help page. And no reset is a guarantee: the 2014 article's author says the only truly secure way to destroy data is physical destruction, though that line is offered half in jest. For most people, a backup, sign-out, encryption and reset on a newer phone is a sensible level of care. If an old phone held very sensitive material, the article's own advice is to keep it.

Key takeaways

• Delete removes the photo from the list, not from storage, until new data overwrites it.
• Avast's 2014 test found photos on phones that had supposedly been reset. The reel cites 20 phones and 40,000+ photos.
• On modern phones, encryption plus factory reset destroys the key, which makes leftover data unreadable.
• Per one guide, recovery risk after a reset is very low for 2018 onward, moderate for 2015 to 2018, and high before 2015.
• Google Photos keeps deleted items in the trash for 30 days, on the page we checked.
• The order that works: back up, sign out, encryption on, factory reset, remove SIM and SD card, check.