Replacing or retiring an Android phone or tablet feels like a simple upgrade until you consider what happens to the data still on the device. Photos, emails, saved passwords, business applications, and account credentials can all survive a basic factory reset if the device wasn’t properly prepared. This guide walks through each step of a thorough wipe, from backup to final disposal, so your data doesn’t follow the device out the door.
Step 1: Back up everything you want to keep
Before touching any settings, go through the device and identify everything worth saving. Android offers built-in backup to Google Drive, covering app data, call history, contacts, device settings, and SMS messages. Photos and videos are best handled through Google Photos or a manual transfer to a computer. For files not covered by automatic backup, check the Downloads folder, any app-specific storage you’ve used, and documents saved locally.
If you use a work device managed by your organization’s mobile device management (MDM) platform, consult your IT team before proceeding. Corporate MDM profiles sometimes handle data backup and remote wipe through a different process, and the steps below apply to personal or unmanaged devices.
Step 2: Encrypt the device
This step is what separates a thorough wipe from a surface-level one. Encryption converts all data on the device into a coded format that is unreadable without the correct decryption key. When you subsequently perform a factory reset, the encryption key is discarded along with the reset, making the underlying data unrecoverable even with forensic tools.
On most Android devices, encryption is enabled by default on Android 6.0 and later. To confirm or enable it, go to Settings and search for “Encryption,” or navigate to Settings > Security > Encryption and credentials. The process can take anywhere from 30 minutes to several hours depending on the amount of data stored, so keep the device plugged into power throughout.
Step 3: Perform a factory reset
With the backup complete and encryption confirmed, the factory reset removes all user data, accounts, and personal settings, returning the device to its out-of-box state. Find the option under Settings > General management or Settings > System, then look for Reset or Factory data reset. The exact path varies slightly by manufacturer and Android version, but the option is available on all Android devices.
Follow the on-screen prompts. The process typically takes 10 to 20 minutes and will restart the device when complete. Do not skip the final confirmation steps, as some devices offer options to retain certain data categories during the reset, which you do not want.
Step 4: Use a data erasure app for additional security
For devices that will be sold or donated rather than physically destroyed, adding a dedicated data erasure app provides an extra layer of assurance. These tools overwrite storage with random data using established algorithms, making recovery even less likely than encryption plus factory reset alone.
Look for apps with verified reviews and a clear description of the overwrite standard they use. Note that some require root access to function fully, which may affect warranty status. For most consumer and business scenarios, encryption plus factory reset is sufficient. Dedicated erasure apps are most appropriate when the device held highly sensitive data.
Step 5: Remove the SIM and SD cards
Before handing the device off, physically remove the SIM card and any microSD card. SIM cards retain account identifiers and, on some carriers, stored contacts. SD cards may contain photos, documents, or app data that the factory reset does not touch, since the reset typically addresses internal storage only.
If the SD card is being passed along with the device, wipe it separately using a computer. Formatting through Android’s storage settings is enough for most cases.
Step 6: Remote wipe as a fallback
If a device is lost or stolen before you complete the wipe process, Android’s Find My Device feature allows you to remotely erase all data as long as the device is powered on and connected to the internet. Visit myaccount.google.com/find-your-phone, sign in with the Google account linked to the device, select Factory Reset. The command executes immediately if the device is online, or queues until the next time it connects if it is currently offline.
Note that once the reset completes, the device’s location becomes unavailable, so this option is best used when you are certain recovery is no longer possible. For business devices managed through an MDM platform, remote wipe is typically available as an administrative function in the management console.
Managing Android devices across your organization requires a secure, standardized offboarding process. Our team can help you build a retirement workflow that protects your data at every step. Get in touch to learn more.