Naked selfies extracted from
'factory reset' phones
By Nicholas Tufnell
Technology reporter
11 July 2014 Last updated at 12:59
Older, second-hand smartphones are at greater
risk of their "wiped" data extracted
Thousands of pictures including "naked
selfies" have been extracted from factory-
wiped phones by a Czech Republic-based
security firm.
The firm, called Avast, used publicly available
forensic security tools to extract the images
from second-hand phones bought on eBay.
Other data extracted included emails, text
messages and Google searches.
Experts have warned that the only way to
completely delete data is to "destroy your
phone".
Most smartphones come with a "factory reset"
option, which is designed to wipe and reset the
device, returning it to its original system state.
However, Avast has discovered that some older
smartphones only erase the indexing of the data
and not the data itself, which means pictures,
emails and text messages can be recovered
relatively easily by using standard forensic tools
that anyone can buy and download.
The company claims that of 40,000 stored
photos extracted from 20 phones purchased
from eBay, more than 750 were of women in
various stages of undress, along with 250 selfies
of "what appears to be the previous owner's
manhood".
There was an additional 1,500 family photos of
children, 1,000 Google searches, 750 emails
and text messages and 250 contact names and
email addresses.
The company said: "Deleting files from your
Android phone before selling it or giving it away
is not enough. You need to overwrite your files,
making them irretrievable."
It was not made clear by Avast whether they
extracted data from all 20 phones.
Destroy the phone
Google responded that Avast used outdated
smartphones and that their research did not
"reflect the security protections in Android
versions that are used by the vast majority of
users".
It was recommended by Google that all users
enable encryption on their devices before
applying a factory reset to ensure files cannot
be accessed.
This feature, said Google, has been available for
three years, although it is not enabled by
default, which could leave less tech-savvy users
open to attack.
Apple has had built-in encryption for its
hardware and firmware since the release of the
iPhone 3GS.
The hardware encryption is permanently
enabled and users cannot turn it off.
Additional file data protection is available, but
must be turned on in the settings menu.
Independent computer security analyst Graham
Cluley said that if a user is serious about privacy
and security they should make sure their device
is always "protected with a PIN or passphrase,
and that the data on it is encrypted".
However, Alan Calder, founder of cybersecurity
and risk management firm IT Governance , told
the BBC that erasing data, even after it has been
encrypted, will not be enough to completely
protect your device.
"Google's recommended routine for protecting
the data only makes it harder for someone to
recover the data - it does not make it
impossible," he said.
"If you don't want your data recovered, destroy
the phone - and that has been standard security
advice, in relation to telephones and computer
drives, for a number of years. Any other
'solution' simply postpones the point at which
someone is able to access your confidential
data."