How to Factory Reset Android Before Selling — The Safe Way
Regular factory reset is not enough — data can be recovered. Encrypt first, then reset Samsung, Xiaomi, Pixel or OnePlus safely before selling.
Table of Contents
- Why a regular factory reset is not enough
- Scenario 1: older unencrypted Android device
- Scenario 2: forgetting to sign out of accounts
- The 8-step pre-sale checklist
- Brand-specific paths
- Samsung (Galaxy S, A, M, F, Z series)
- Xiaomi / Redmi / Poco (HyperOS / MIUI)
- Google Pixel (stock Android)
- OnePlus (OxygenOS) and Oppo / Realme (ColorOS)
- Vivo / iQOO (FunTouch OS / OriginOS)
- What stays behind vs what is gone after factory reset
- Verifying nothing is recoverable (paranoid-mode optional)
- What does not work despite common advice
- Common mistakes that cause buyer disputes
- Region-specific buyer expectations
- What to do if you already factory-reset without these steps
- When to call a professional
The default advice — “factory reset before selling” — is correct but incomplete. Skipping the encryption-first step on older devices, or forgetting to sign out of Google before reset, are the two most common mistakes that put your data and identity at the next owner’s disposal. This guide is the complete, brand-aware checklist for properly sanitising your Android before sale, including the few extra steps that matter on Samsung devices specifically and the mistakes that turn an “I sold my phone safely” story into an identity-theft story.
Why a regular factory reset is not enough
Two specific scenarios where the default advice fails:
Scenario 1: older unencrypted Android device
Android 7 and earlier did not encrypt by default. Many Android 8/9 devices shipped with encryption optional. On these devices, a factory reset deletes the file system table and marks the storage as available — but the data on the storage cells remains until overwritten by new data. Forensic recovery tools can read directly from the storage cells and reconstruct deleted files.
The fix: enable encryption first, then factory reset. The encryption process re-writes the storage with encrypted data; the reset destroys the encryption key. The combination renders the data mathematically unrecoverable.
Scenario 2: forgetting to sign out of accounts
If you reset without first removing Google, Samsung, or Xiaomi accounts:
- Google account left on device → triggers Factory Reset Protection (FRP). Buyer cannot set up the phone without your credentials. They will demand a refund or attempt FRP bypass; either way you have a problem.
- Samsung account left on device → similar device-lock mechanism. Buyer cannot use Samsung-specific features without your credentials.
- Mi/Xiaomi account left on device → similar; buyer locked out of Mi-account-dependent features.
The fix: sign out and remove all accounts before reset. Settings → Accounts → tap each → Remove account.
The 8-step pre-sale checklist
-
Back up everything you want to keep
Photos via Google Photos / OneDrive / USB to PC. Documents via Drive / OneDrive / USB. Contacts via Google Contacts (Settings → Accounts → Google → Contacts → Sync now). WhatsApp chats via WhatsApp → Settings → Chats → Backup.
-
Sign out of all accounts
Settings → Accounts → remove Google, Samsung, Mi, Microsoft, Facebook, Twitter, Telegram, etc. This step prevents Factory Reset Protection from locking the buyer out.
-
Verify the device is encrypted
Settings → Security → Encryption. Modern Android (10+): on by default, verification only. Older Android: enable encryption now if off, wait for completion.
-
Disable Find My Device and similar tracking services
Settings → Security → Find My Device → off. Same for Samsung's SmartThings Find, Xiaomi's Find Device. These can otherwise track the device after sale.
-
Optional belt-and-braces: fill storage with junk before reset
Record a 30+ minute 4K video, or copy a large junk file repeatedly until storage is nearly full. Overwrites physical storage cells. Adds protection on older devices.
-
Perform the factory reset
Settings → System → Reset → Erase all data (factory reset) → confirm. Wait for the device to reboot and reach the setup wizard.
-
Walk through setup wizard, skip everything, then reset again
Optional but recommended for high-value devices. The double-reset clears any data accumulated during the first setup wizard walkthrough.
-
Note the device's actual condition for the buyer
Be honest about previous root status (this is permanent on Samsung Knox), screen condition, battery health (Settings → Battery → Battery health where available). An honest sale prevents disputes.
Brand-specific paths
Samsung (Galaxy S, A, M, F, Z series)
- Settings → Accounts and backup → Manage accounts → remove Samsung account, Google account, every other account
- Settings → Biometrics and security → Find My Mobile → off
- Settings → General management → Reset → Factory data reset → confirm
- Knox check: boot into Download Mode (Volume Down + Power) and check the Knox warranty status displayed on screen. “Knox Warranty Void: 0x0” means the device was never rooted; “0x1” means it was. Disclose to buyer if 0x1.
Xiaomi / Redmi / Poco (HyperOS / MIUI)
- Settings → Mi Account → sign out
- Settings → Google → manage accounts → remove
- Settings → About phone → Factory reset → confirm
- Older HyperOS/MIUI versions allow optional “Format internal storage” toggle during reset — check this box for thorough wipe
Google Pixel (stock Android)
- Settings → Accounts → remove every account
- Settings → Security → Find My Device → off
- Settings → System → Reset options → Erase all data (factory reset) → confirm
- Pixel-specific note: Titan M2 secure element guarantees that the device’s previous Google account credentials are cryptographically wiped during reset; modern Pixels are particularly safe to factory-reset-and-sell
OnePlus (OxygenOS) and Oppo / Realme (ColorOS)
- Settings → Accounts → sign out of every account
- Settings → Privacy → Find My Device → off (or equivalent in ColorOS)
- Settings → System → Reset options → Erase all data → confirm
Vivo / iQOO (FunTouch OS / OriginOS)
- Settings → Accounts and sync → remove every account
- Settings → System management → Backup and reset → Erase all data → confirm
What stays behind vs what is gone after factory reset
Gone (cannot be recovered after reset on a modern encrypted device):
- All photos, videos, documents in user storage
- All app data (chat history, login tokens, app preferences)
- All accounts and passwords
- Browser history and bookmarks
- Custom settings and personalisations
- Wi-Fi network passwords
Stays behind (intentionally; not your private data):
- The phone’s OS (firmware, system apps)
- Pre-installed manufacturer apps (the buyer can disable/uninstall these themselves)
- Boot animations, ringtones, and other manufacturer-shipped content
- The device’s IMEI, serial number, and hardware identifiers (these are physical to the device; cannot be changed)
Stays behind on previously-rooted devices (this is the gotcha):
- Magisk Manager APK if it was installed as a system app
- Custom recovery (TWRP/OFRP) if installed
- KernelSU components if used
- Custom kernel
- Knox warranty bit on Samsung (permanent; physical e-fuse)
If you are selling a device that was previously rooted, you must either disclose this to the buyer or perform a full firmware reflash + bootloader relock (where supported) before sale. On Samsung specifically, Knox cannot be reset.
Verifying nothing is recoverable (paranoid-mode optional)
For high-value devices or buyers who specifically request verification:
- After the final reset, connect the device to a PC with the device unlocked and screen on
- Run a recovery tool like Wondershare Recoverit or EaseUS MobiSaver against the visible internal storage
- On a properly-encrypted-then-reset modern Android, the tool will see only the new file system with no recoverable user data; modest “system” entries are normal and not user content
- Optional: take a screenshot showing “no recoverable data” and share with the buyer for transparency
What does not work despite common advice
To save you time:
- “Antivirus apps that scan and clean before sale” — useless for sanitisation; the factory reset is what matters
- “Format internal storage” via developer recovery menu — equivalent to factory reset on encrypted modern devices; no additional benefit
- Holding power button until the device “completely shuts down” before reset — does nothing meaningful for data sanitisation
- Removing the SIM card and SD card “to delete data” — only removes data on those specific physical cards; does nothing about internal storage
Common mistakes that cause buyer disputes
Real cases we have seen:
- Sold without removing Google account → buyer hits FRP screen on first boot → demands refund. Fix took an hour of remote work to clear.
- Sold without disclosing previous root → buyer ran Knox check → returned the phone for false advertising. Lost 30 percent of resale value.
- Sold with Samsung account still attached → buyer locked out of Samsung Pay setup → return.
- Sold without first-boot test by seller → buyer received phone that did not boot past setup wizard due to corrupted reset → bad-buyer dispute followed by genuine refund. Test boot before shipping.
Region-specific buyer expectations
After hundreds of remote-cleanup jobs for sellers and buyers across our service regions, the patterns we see:
- Bangladesh / Pakistan / India — second-hand buyer expectations are high; buyers routinely run Knox-status checks on Samsung devices and refuse purchase if Knox is 0x1. Many buyers also run forensic recovery tools as a self-protective check, particularly for devices over $500 equivalent. Disclose previous root status upfront; expect a 20-30 percent price haircut for previously-rooted devices.
- UK / EU — buyers are less likely to check Knox status but more likely to dispute via the platform (eBay, Gumtree, Vinted, Marktplaats) if FRP locks them out. Always remove Google account before listing; respond to any “phone is locked” buyer message within hours.
- US — carrier-locked devices add a layer; verify the device is carrier-unlocked before listing or disclose explicitly. Verizon and AT&T variants of major brands are the most-disputed sales when carrier-lock is not disclosed.
What to do if you already factory-reset without these steps
If you have already reset and shipped or are about to ship, two situations to handle:
- Forgot to remove Google account → Factory Reset Protection triggered. Buyer cannot complete setup without your Google credentials. Two options: temporarily provide your credentials to the buyer (then change your Google password immediately after they confirm completion of setup); or take the device back, complete a remote sign-out via Google’s Find My Device “Erase device” option, then re-ship.
- Forgot to encrypt before reset on a pre-Android-10 device. The data has been deleted but is potentially recoverable. Two options: take the device back and run the encrypt-first procedure properly; or, if the device is already with the buyer, change the passwords on every account that was on the device (Google, banking apps, social media, email) as a precaution. Treat any sensitive data on the device as compromised until proven otherwise.
The right play in both cases is preventive — do the steps in the proper order before sale rather than handling these recovery scenarios afterwards.
When to call a professional
If you want a guaranteed-clean, professionally-sanitised phone before sale — particularly for devices that were previously rooted, devices with high resale value, or devices where you need verifiable confirmation for the buyer — message us on WhatsApp or Telegram. The service includes full firmware reflash to factory state, bootloader relock where supported, Knox status verification on Samsung, and a written summary you can share with the buyer. We can also help buyers recover data from devices they purchased without proper reset — if you bought a used Android and want to check what survives, see our data recovery service.
Frequently Asked Questions
Is a regular factory reset enough to protect my data when selling my Android?
On a modern fully-encrypted Android phone (Android 10+, which is essentially every device sold since 2020), yes — a single factory reset is sufficient. The encryption key is destroyed during reset and the encrypted data on the storage becomes mathematically unrecoverable, even with forensic tools. On older Android (Android 8/9 or earlier), a regular factory reset is NOT enough — those devices may have data that survives reset and can be recovered with consumer-grade forensic tools. For older devices, encrypt first then reset.
Can someone recover my deleted data after a factory reset?
Modern encrypted Android (10+): no, even with professional forensic tools — the encryption key is destroyed and the underlying data is mathematically unreadable. Older unencrypted Android (8/9): yes, some data is recoverable with consumer-grade tools like Wondershare Recoverit, EaseUS, or DiskDigger; more is recoverable with professional forensic tools. For peace of mind on older devices: encrypt first, then reset, then optionally fill storage with junk before reset.
What is Factory Reset Protection (FRP) and how do I avoid leaving it active?
FRP is a security feature that locks an Android device to its previous Google account after factory reset — designed to make stolen phones unsellable. If you reset without first signing out of your Google account and removing it from the device, the next owner will be unable to set up the phone without your Google credentials. To avoid this: Settings → Accounts → remove all Google accounts BEFORE factory reset. Same applies to Samsung accounts (also enforce post-reset login on Samsung devices) and Mi accounts on Xiaomi devices.
How do I factory reset different Android brands?
Path varies slightly by brand: Samsung — Settings → General management → Reset → Factory data reset. Xiaomi/Redmi/Poco — Settings → About phone → Factory reset. Pixel — Settings → System → Reset options → Erase all data (factory reset). OnePlus — Settings → System → Reset options → Erase all data. Realme/Oppo — Settings → System settings → Backup and reset → Erase all data. The encrypt-first-then-reset principle applies on all brands.
Should I reset to factory and reflash firmware before selling?
For most consumer devices, factory reset alone is sufficient. Reflash firmware (full ROM reflash) is overkill unless: (a) the device was previously rooted and you want to remove all traces of root before sale, (b) the device shows persistent issues that factory reset does not fix, or (c) you suspect malware that survived factory reset (rare on stock devices, possible on previously-rooted devices). For previously-rooted devices, full firmware reflash + relock bootloader (where supported) restores closer to factory state.