Does Factory Reset Remove Everything? The Real Answer

A laptop is returned after an employee exit. A phone is headed for trade-in. A batch of workstations is being replaced. The question is usually the same: does factory reset remove everything? For organisations responsible for confidential records, customer data, credentials and regulated information, the answer is not reliable enough to be a simple yes.

A factory reset is designed to make a device usable again. It removes user settings, installed applications and locally stored content from the operating system’s perspective. That is useful for troubleshooting and personal handoffs. It is not automatically the same as a verified sanitisation result.

The distinction matters when equipment will leave your control. If data remains recoverable, a reset can create exposure long after the device looks clean.

Does a factory reset remove everything?

No, not reliably. A factory reset restores the operating system to its default state, but depending on the device, the reset option and the storage type, data can remain recoverable, especially on computers.

Factory reset behaviour depends on the device, operating system, storage type and encryption status. On many modern devices, a reset removes the file system references that tell the operating system where data is located. The device then treats that storage space as available for new use.

That does not always mean the underlying data has been overwritten or rendered unrecoverable. Until storage sectors are replaced with new information, specialised recovery methods may be able to identify remnants of deleted files. The risk is not theoretical for older systems, improperly configured devices or media with sensitive information that has not been securely sanitised.

A reset also does not address every location where business data may exist. Local data can include browser profiles, saved passwords, email cache files, temporary documents, synced folders, virtual machine images, recovery partitions and application databases. A standard reset may handle some of these items, but it is not a universal verification process.

For IT teams, the operational question is more precise: which sanitisation method was applied to this asset, what result was reported and does that meet the organisation’s policy? A factory reset alone rarely supplies that record or assurance.

What a factory reset usually removes

On Windows, macOS, Android and iOS devices, reset functions generally remove user accounts, installed apps, personal settings and files stored in standard user locations. They may reinstall the operating system or return the device to an out-of-box setup experience.

This is sufficient when a device is staying within a controlled environment and the goal is to correct a software issue. For example, a technician may reset a laptop before reissuing it to the same organisation, then apply its standard image and security controls.

Even in an internal redeployment, a reset should not be treated as the only security control when the prior user had access to highly sensitive data. The device’s encryption state, asset history and destination all affect the correct process.

What a factory reset may leave behind

A factory reset can leave recoverability concerns because it is primarily an operating system function, not a dedicated media sanitisation procedure. The most common gaps involve data that is deleted logically but not securely erased at the storage level.

Traditional hard disk drives are particularly relevant here. Deleted data can remain on the disk until it is overwritten. Recovery software may reconstruct files, folders or file fragments when the underlying sectors have not been sanitised.

Solid-state drives require their own consideration. SSDs use wear levelling, overprovisioning and flash management processes that can move data outside the locations visible to the operating system. Simply overwriting files from within an installed operating system may not reach every physical storage location. An appropriate sanitisation approach must account for the drive type and its supported erase capabilities.

Other data sources can be missed as well. Removable media, secondary internal drives, external drives, network shares, cloud storage and backups are separate from the device reset process. Resetting a laptop does not delete a user’s cloud account or remove files stored on a USB drive left in a desk drawer.

Encryption changes the risk, but it is not a blank cheque

Encryption can significantly reduce the risk of recovery. If a device was fully encrypted before use and the encryption keys are securely destroyed during the reset process, the remaining encrypted data may be computationally inaccessible.

However, this depends on facts that must be verified, not assumed. Was full-disk encryption enabled from the beginning? Were all volumes encrypted? Were recovery keys protected? Did the reset actually remove the cryptographic keys? Is there a documented process showing the device’s encryption state?

For managed mobile devices, encryption plus a properly executed remote wipe can be a strong control. For mixed fleets, older hardware, unknown devices or assets with incomplete management records, relying on presumed encryption creates uncertainty. Organisations with compliance obligations need evidence that matches their risk level.

Factory reset vs secure data erasure

The difference is purpose and evidence. A factory reset prepares a device for use. Secure data erasure is intended to make practical recovery infeasible at the assurance level provided by the completed method and provide a record of the reported result.

A secure erasure workflow should identify the storage media, apply an appropriate sanitisation method, verify completion and document the result. This is especially relevant for devices being sold, donated, recycled, returned at lease end or transferred to a third-party IT asset disposition provider.

Standards-based wiping processes provide a stronger foundation than an operating system reset because they are built around data destruction requirements rather than user convenience. Alignment with recognised frameworks such as NIST and IEEE helps organisations establish consistent controls across device refreshes, offboarding events and retirement projects.

For regulated organisations, this is not just an IT task. It supports obligations under privacy and security requirements, including GDPR and HIPAA, where improper disposal of personal or protected information can create legal, financial and reputational consequences.

Is a factory reset enough to wipe data?

Sometimes, on modern encrypted phones where the reset destroys the keys. For computers leaving your control, use a sanitisation method applied to the whole drive and record the result.

A reset can be reasonable for low-risk troubleshooting on a device that remains under organisational control. It may also be part of a broader reimaging workflow where the storage will be securely erased separately before the asset is reassigned.

It is not the right final step when a device contains sensitive company data and will be transferred outside the organisation. That includes resale, donation, recycling, warranty return, employee purchase programmes, lease returns and disposal. In those cases, the standard should be an appropriate sanitisation method with the reported result documented.

The same principle applies to employee offboarding. Resetting an employee’s computer may remove their visible profile, but it does not show that an appropriate sanitisation process has completed. Secure erasure should occur before the hardware changes hands or leaves the facility.

A defensible device retirement process

A reliable process starts before the wipe. Confirm the asset identifier, serial number, assigned user, data classification and intended disposition. Remove the device from management platforms and preserve any records required for retention or legal hold before erasure begins.

Next, determine the media type and use a sanitisation method appropriate for that hardware. Verify that all internal storage is included. Devices often contain more than one drive, and removable or external media should be tracked separately.

After wiping, retain an auditable record of completion. The record should connect the device to the erasure event and can support internal reviews, customer requirements and compliance audits. A clean-looking setup screen is not evidence of secure destruction.

For organisations managing recurring hardware refreshes, a USB-based wiping solution can make this process repeatable across desktops and laptops without per-device subscription limits. Our RedKey USB supports this operational need with standards-led data erasure, unlimited wipes and a straightforward process for teams that need to retire or redeploy assets with confidence.

A factory reset has a place in device management, but it should not be confused with a data destruction policy. When a device is leaving your control, treat its storage as a security liability until an appropriate sanitisation method has been applied, its reported result checked and the required record retained.

Frequently asked questions

Does a hard reset delete everything?

No. A hard reset usually means restarting or restoring a device to factory settings, and neither is designed to sanitise every part of the storage. On computers, data can remain on the drive unless a proper erasure method is used.

Does factory resetting a laptop delete everything?

Not reliably. Windows "Reset this PC" with the "clean the drive" option overwrites more than a quick reset, but it covers only the system drive and is not designed as a verified sanitisation process. A bootable erasure tool that covers every detected drive gives a clearer result.

What does restoring factory keys do in the BIOS?

"Restore factory keys" resets the Secure Boot certificates stored in the computer's firmware to the manufacturer defaults. It does not erase the hard drive or delete your files.

If you reset a laptop, is the old data still traceable?

It can be. Depending on the reset method and the drive type, recovery software may still find old files. Proper sanitisation of the whole drive, with a checked result, is what makes recovery infeasible.

Does a factory reset delete search history?

A reset removes the user account and browser profile, so local search history normally disappears from view, but the underlying data may still be recoverable from the drive. History synced to an online account is unaffected and must be cleared in that account.

If you are preparing a single home computer for sale or recycling, RedKey USB Home erases one or more supported disks, including the operating system disk, from a bootable USB. Related reading: Disk Wiping vs Factory Reset for Secure Disposal and Can Deleted Data Be Recovered? Usually, Yes.