A Forensic Analysis of Residual PII on Secondary-Market Android Devices

Phones are sold second-hand very often, including at yard sales, eBay, and flea markets. Many of the phones that are resold may retain traces of this information, which could be exploited if recovered by a malicious party. This research explores the risks of buying and selling used Android phones by looking for personally identifiable information (PII), which is any data that can be used to identify or track a person. PII ranges from sensitive details, such as Social Security numbers and credit card information, to less sensitive details, such as names, phone numbers, and birthdates. Using digital forensics software, this project examines Android phones purchased through online marketplaces and informal sales to see what personal information may be left behind. The study also considers whose information is stored on these devices, looking at data that belongs to the original owner as well as data that belongs to other people, such as friends, family, and coworkers. The goal of this work is to raise awareness of the hidden risks of reselling phones and to help consumers understand how to better protect their personal information.