0

A few months back, I had deleted a media file from my gallery. My phone wasn't encrypted at this point. Now, I wish to ensure that this file cannot be recovered in any way. What is the best way of doing this? Is it sufficient to encrypt my phone and do a factory reset? Or do I need to overwrite the memory blocks using software?

Train Heartnet
  • 353
  • 2
  • 4
  • Is your device rooted? Securely deleting a file on an unencrypted flash storage is pretty hard. Enabling encryption usually only encrypts the used space. The best method would be to fill the remaining free space with random data. However in such a case the spare sectors (used for wear leveling) may not be overwritten. – Robert Jul 03 '20 at 12:42
  • It's not rooted (still on warranty, so really wish to avoid any solution involving rooting). So what would you suggest to ensure that those spare sectors are also overwritten? – Train Heartnet Jul 03 '20 at 12:46
  • The only thing you can do is overwrite the free space with random (up to only a few bytes are left). Wait a minute and delete the created files with random data. And then do the overwrite again. After may be 4-5 rounds the chance is high that all sectors has been overwritten. BTW: What phone that is still on warranty comes unencrypted nowadays? I thought encryption is nowadays active by default on all devices (enforced by Google). – Robert Jul 03 '20 at 13:08
  • A better approach than overwriting the whole free space with random data would be to perform a factory reset. Hopefully if your hardware and kernel supports, BLKDISCARD command will be called for userdata partition which erases everything at lower level. But in fact there is no way to ensure 100% that your file is no more recoverable. Shredding and BLKDISCARD both erase only the physical blocks which currently belong to logical blocks (filesystem) of your /data partition. But possibly the physical sectors where actual file was written no more belong to /data partition. ... – Irfan Latif Jul 03 '20 at 14:26
  • ... They might have been allocated to some other partition or over-provisioning space as Robert said. FTL firmware handles this all. So you data might still be recovered by chipping off the flash storage circuit and bypassing the FTL. However that happens only in forensic labs. – Irfan Latif Jul 03 '20 at 14:26
  • See my answers to How to make a complete factory reset, without anyone being able to retrieve my data? and Can user data be recovered after formatting and flashing stock ROM? – Irfan Latif Jul 03 '20 at 14:27

0 Answers0