Using the volume buttons “up” and the power button (press together until the word Samsung appears in the display and then release the buttons), the Samsung Galaxy S (I9001) gets into recovery mode.
Once the Android logo appears on the screen and the touch-sensitive buttons light up at the bottom of the screen, you have to push 1x on the left button. After a few seconds you see the menu options on the screen.
Using the menu keys, you can now choose “wipe data / factory reset” .
The expectation is that you really wipe the phone, leaving no recoverable traces.
For security reasons you will have to choose: “Yes ** Delete all user data”.
After performing the above-mentioned factory reset, the phone has been investigated using the UFED Touch.
In this case a Physical Image made from the internal memory of the phone. (The phone has no SD card present)
After extracting the phone-data using the Ufed Touch we notices there where at least pictures to be found. At first we did not find anything else then the pictures.
We looked at the image using WinHex. Here we notices there where multiple traces of the use of Whatsapp to be found.
We mounted the just made image and found multiple folders with user-data.
The folder DCIM/Camera/ still contained pictures and movies.
The folder Whatsapp/Database/ still contained a few complete databases containing Whatsapp chatsessions.
Using Belkasoft software we investigated the left traces on the phone. We found multiple traces of the use of apps like Twitter, Kik, Whatsapp, Facebook and we also found SMS messages.
After a factory reset your phone is not free of user-traces. Your private information can still be found on the device.