Existing users, 
Refurbished iPhones may contain other users’ personal data
Posted 19 May 2008 @ 10am in Security, News
iPhones sold as refurbished units may contain personal data from their previous owners that, with a little leg-work, is readily accessible by new owners. These data include email, images, contacts and more.
As previously noted, performing a “Restore” operation on the iPhone does not delete personal data from the device. Such information remain intact on the device after a restore, making the process unsuitable as a preparatory measure for iPhone resale or service. Apparently, Apple’s refurbishing procedure also does not delete the personal data.
As noted by Jonathan Zdziarski, author of the “iPhone Open Application Development” and an iPhone Forensics Manual for Law Enforcement:
“A verified detective from the Oregon State Police notified me this afternoon that an out-of-the-box refurbished iPhone he purchased contained recoverable personal data including email, personal photos, and even financial information which he was able to recover using my forensic toolkit. The photos he sent me included the individual’s name, which I’ve blurred out myself, but if you’ve ever had to return a defective iPhone, you might recognize this inbox. The more sensitive information hasn’t been posted here for obvious reasons.”
At left is actual stored data from a refurbished iPhone: a screenshot that the iPhone took itself of the user’s inbox when its user pressed the ‘Home’ button. Application snapshots are taken every time a program goes into the background to generate the zoom effects built into the device.
There currently exits no viable, publicly available method for erasing personal data on the iPhone. Erasing your content and settings has no effect on whether a subsequent owner can recover personal information. According to Zdziarski “there are only a couple low-level methods to format the NAND and I’m not sharing at the moment.”
Feedback? info@iphoneatlas.com.
Print This Post
3 Comments
Posted by seika7
19 May 2008 @ 11am
Why not just erase/restore to make space, then fill it to capacity with music to overwrite every bit of memory? Do it again with different music if you feel the need.
–Bryan
Posted by lau_jeff
20 May 2008 @ 8am
I’m a little surprised that Zdziarski of all people with withold how to wipe our data out completely. Unless we can do some other damage to the phone they way, it just seems odd.
Posted by fun stuff
20 May 2008 @ 9am
Based on that stance, seems likely he will create an application to do this and then sell it. That’s what I’d do, since no one else in the community has figured out how to do it and given it away for free.