Secondhand Devices, Firsthand Exposure: Inside the Data Americans Accidentally Sell at Every Yard Sale
Photo: Neil Theasby , CC BY-SA 2.0, via Wikimedia Commons
Every weekend across the United States, millions of storage devices change hands. Facebook Marketplace listings advertise 'wiped and ready' external drives. Estate sales move boxes of old laptops. eBay processes a steady stream of retired smartphones and network-attached storage units. Most sellers believe they've erased what's inside. Forensic researchers who purchase these devices on a regular basis know better.
The Reset That Isn't
The core problem is a mismatch between what a factory reset appears to do and what it actually does. On many devices, a reset removes the index pointing to your files — not the files themselves. The data remains on the flash memory or platters until something else overwrites it, and consumer resets frequently never touch those sectors.
Traditional spinning hard drives are the most forgiving for buyers and the most dangerous for sellers. Deleting a folder and emptying the Recycle Bin does essentially nothing. Even a full Windows reinstall can leave previous user folders intact in unallocated space, where inexpensive recovery software can pull them back in minutes.
Solid-state drives complicate the picture differently. TRIM commands eventually scrub deleted blocks, but that process depends on the operating system, the controller, and time. A drive pulled from a machine and sold the same week may retain a surprising amount of readable material.
What Investigators Keep Finding
Security teams that acquire used hardware from mainstream marketplaces have published findings that should unsettle any seller. In widely cited audits, a meaningful share of purchased drives contained recoverable personal information: scanned tax documents, photographs with embedded GPS coordinates, saved browser sessions with active cookies, and in a smaller but persistent number of cases, corporate databases and customer records.
The pattern repeats with phones. A factory reset on an unencrypted or older device can leave text message databases, app data caches, and photo thumbnails recoverable with consumer-grade tools. Network-attached storage units are a category of their own — sellers often forget that a NAS may contain RAID-configured disks holding years of household or small-business files, and that simply unplugging the unit doesn't anonymize it.
What Sellers Should Do Before Handing Anything Over
The remedy depends on the storage medium, and a one-size-fits-all approach fails.
For hard disk drives: Use a dedicated wiping utility that performs a full overwrite of every sector — not a quick format. Tools like DBAN or the manufacturer's secure erase utility write patterns across the entire surface, making prior content unrecoverable by any practical means.
For solid-state drives: Overwriting tools can be defeated by wear-leveling, so the correct method is the controller's built-in Secure Erase or Sanitize command, available through the manufacturer's software or a bootable utility. When in doubt, encryption first, then erase.
For smartphones: Enable encryption well before the reset (on modern iPhones and Android devices this is default), then perform the factory reset from the settings menu, and remove the device from any cloud account to avoid activation lock complications for the buyer.
For NAS units and multi-drive enclosures: Pull every disk, wipe each one individually, and never assume the enclosure's own 'reset' touches the drives.
The strongest option for drives containing truly sensitive material remains physical destruction — a professional shredding service, not a hammer in the garage, which often leaves platters largely intact.
The Buyer's Side of the Transaction
There's a flip worth noting. Purchasers of used devices should treat every secondhand drive as potentially contaminated. Recovering a previous owner's files — even accidentally — can create legal exposure under federal and state computer misuse and privacy statutes. The prudent practice when buying used storage is to perform a full secure erase immediately upon acquisition, before the drive ever touches your network.
A Market With No Erase Standard
Unlike vehicles, which carry title history, used storage devices carry no disclosure requirement in the United States. Marketplace platforms don't verify wipes, and 'factory reset' in a listing means whatever the seller thinks it means. Until that changes, the responsibility sits entirely with the person holding the device.
Before your next garage sale or Marketplace listing, ask a simple question: if a stranger with free software plugged this in tonight, what would they learn about your life? If the answer is anything more than nothing, the device isn't ready to sell.
