[HTC Wildfire S] no.human.being:
Due to my strong involvement with IT security, today I made an analysis of how effective several wipe-options are on Android phones. I tested this on an HTC Wildfire S (Marvel) running CWM-5.0.2.8 recovery and an inofficial CyanogenMod 7.2 build from 2012-07-17 as ROM.

For the test I first created a memory dump as well as a NANDroid backup of my entire phone. The memory dump was created using the following commands on an adb shell with the Recovery.

cat /dev/mtd/mtd4 > /sdcard/pre-wipe/cache.img
cat /dev/mtd/mtd5 > /sdcard/pre-wipe/userdata.img
cat /dev/mtd/mtd6 > /sdcard/pre-wipe/devlog.img

I didn't dump mtd0 to mtd3 since these should contain firmware-related data only so there should be no sensitive information here.

Then I booted the phone into CM and did a factory reset. After this was performed, I went back into recovery and created another set of dumps under "/sdcard/wipe-android/*". Afterwards I booted into CWM and restored the NANDdroid backup to prepare for the next test.

I then used the wiping options of CWM on the phone and created a set of dumps under "/sdcard/wipe-cwm/*". Then I restored the NANDroid backup to prepare for the next test.

I shut down the phone and booted it into HBOOT mode, performing a "Factory Reset". After this, HBOOT will boot the ROM, at which point I pulled the battery to prevent the ROM from writing too much to the wiped partitions.

Then I booted back into CWM, took a build of "mtdutils" and did an erasure of mtd5 (userdata) followed by a dump to "/sdcard/wipe-mtdutils/userdata.img".

Then I loaded all these images onto my computer and did a hex comparison. I went through the "pre-wipe/userdata.img" image and saw that the string "Thank you" appears lots and lots of times in several e-mails and SMS messages and so on. So I went through the other userdata dumps and searched for "Thank you" but nothing was found. Not even in the simple "Factory reset" case performed from within the ROM. I expected the ROM to run "mkfs" getting rid of the file system but not of actual data (like what happens when you "format" a drive on a PC - the operating system won't be able to find data anymore, but it's still there on the device and ready to be recovered with the appropriate tools - at least on magnetic hard drives - solid-state-drives make use of the TRIM/Discard command that newer operating systems implement that will actually erase data from the Flash memory inside the SSD, even though it's not considered "secure" and "ATA secure erase" should be used on such drives when security against remanent data is important - also beware that, unless you run Linux and massively tweak your operating system, TRIM/Discard is not used on encrypted drives) but it appears that the data is actually gone (even though some metadata was still in place).

What's interesting is that the images look different after all "wipe" methods. The wipe from within Android leaves most metadata intact, followed by the wipe from within HBOOT, then the wipe from within CWM and the wipe using "mtdutils", as we expected, actually leaves nothing on the device. All pages are cleared to either 2048 bytes of 0x00 (all zeroes) or 2048 bytes of 0xff (all ones). What's interesting is that different pages get reset to different values, so after an "mtdutils" erase there are NAND pages that are actually fully erased (2048 bytes of 0xff), while others are fully programmed (2048 bytes of 0x00). I don't really understand why this is so, but all pages get cleared to one of these two values so this shouldn't leave traces on the device.

So conclusion? Even the most basic wiping method (Factory reset from within the ROM) seems adequate when selling the phone. Chances are that there

might

be something recoverable with physical access to the NAND chip or the processor (e. g. JTAG access) as the processor makes use of memory virtualization and has address space that is hidden from the user. In particular, devices with eMMC memory (e. g. devices running on MSM8xxx chipsets) might hold remanent data that's invisible from the processor as a whole, since these chips are "overprovisioned" and make use of internal (integrated into the memory package) wear-levelling and bad block replacement that is transparent to the processor and therefore firmware, much like an SSD does inside a computer. So if you have somthing to hide from the CIA, you better physically destroy the phone. However, an "mtdutils"-wipe will probably make your data unrecoverable for at least 99.99 % of the population and thus should be enough for literally any case. Even a simple factory reset from within your ROM seems to dispose of most sensitive data, so this should also serve at least 98 % of all cases.

Beware that this test was performed on a HTC Wildfire S with the (currently) most recent inofficial CyanogenMod 7.2 build from 2012-07-17 installed. Other ROMs may not be as thorough, so take the information from this post only as a guideline. When in doubt, verify the erasure yourself. It's not too hard.