Flawed Android factory reset leaves crypto & login keys ripe for picking

http://arstechnica.com/security/2015/05/flawed-android-factory-reset-leaves-crypto-and-login-keys-ripe-for-picking/

Android's factory reset leaves private information behind on 630 million devices

http://betanews.com/2015/05/22/androids-factory-reset-leaves-private-information-behind-on-630-million-devices/

Securely erase data on Android devices with iShredder 3

http://www.abnewswire.com/pressreleases/securely-erase-data-on-android-devices-with-ishredder-3-for-android_6876.html

iShredder 3 for Android web site

https://www.protectstar.com/en/products/ishredder-android / 500 million Android smartphones smart phones don't completely wipe data factory reset option weakness recovery of login credentials text messages e-mails contacts computer scientists comprehensive study Cambridge University researchers recover data wide range of devices run factory reset built into Google's Android mobile operating system crucial means for wiping confidential data devices resold sold recycled retired study data recovered users turned on full-disk encryption devices studied researchers estimated may not fully wipe disk partitions sensitive data stored 630 million phones wipe internal SD cards pictures video published research paper Security Analysis of Android Factory Resets wake-up call individual users large enterprises major impact organizations mature established disposal practices not effective Kenn White North Carolina computer scientist paper staggering number of devices exposed somebody's Gmail password images photos text chat private reset researchers tested factory reset 21 Android smartphones versions 2.3.x to 4.3 mobile OS sold by five manufacturers retained at least some fragments of old data contact data stored phone app third-party apps Facebook What'sApp images video camera text-based conversations SMS e-mail apps researchers were able to extract master token access to most Google user data Gmail Google calendar experiment researchers recovered a master token reset phone restored the credential file reboot phone successfully re-synchronised contacts emails recovered Google tokens flawed Factory Reset master token tokens other apps tokens access anyone's account storing data reset failures manufacturers didn't include the software drivers fully wipe flash chips non-volatile memory storage researchers demonstrated flash drives dangerously hard to erase drives accommodate portions partitions faulty wear out over time researcher Bunnie presentation 2013 Chaos Communication Congress Flash drives not storing data storing a probabilistic approximation of your data deleting researchers experiments second-hand phones Android versions past 4.3 factory reset version 4.4 researchers newer devices data users wiped reset recovered read protected full-disk encryption file stores decryption key isn't erased during the factory-reset process key encrypted cryptographic salt user-selected PIN or password recovery crypto footer encrypted file attacker offline cracking attack data supplied security consultant White successful crack PIN longer passwords sell dispose remotely wipe full-disk encryption turn it on use a randomly generated password includes numbers upper- and lower-case letters symbols minimum of 11 characters passwords years or decades to crack overwriting all unallocated space installed manually prevent a Google token wiped phone destroy devices rather than sell or recycle them paper published titled Security Analysis of Consumer-Grade Anti-Theft Solutions Provided by Android Mobile Anti-Virus Apps significant wiping flaws /