I was about to check something on my Samsung phone when it suddenly shut down and showed the Samsung startup screen. A short time later, the phone rang, and the display showed that it was erasing data even though I had not started a reset. When it booted again, it displayed the initial welcome screen, confirming that it had been restored to factory settings. My photos, notes, documents, and other files are gone, and I'm especially worried because the phone contained personal information. Is there any way to determine what triggered the reset or recover my data?
4 Answers
Was the phone purchased second-hand? If so, the previous owner might still have had it linked to an account and could have initiated a wipe, especially if the device was reported lost or stolen. Contact the seller and verify the phone’s purchase history and serial or IMEI information. If it was bought new, remote access through one of your accounts becomes more likely.
This may have been a remote wipe. Someone with access to the Google account connected to the phone can use the device-finding service to erase it remotely. Check your Google account from another trusted device, review recent sign-ins and connected devices, change the password, and enable two-step verification. Also secure your Samsung account and any important accounts that were signed in on the phone.
The welcome screen means the phone completed a factory reset, not just a normal reboot. Before setting it up extensively, check whether your photos, contacts, notes, and documents were synchronized with Google Photos, Google Drive, Samsung Cloud, OneDrive, or another backup service. Restore only after confirming the accounts are secure. If there was no backup, recovery after a modern Android factory reset is usually very difficult, so a reputable data-recovery professional may be the only remaining option.
Think carefully about what happened immediately before the reset. A remote wipe, a security or device-management action, or an accidental factory-reset command could all produce this behavior. Look for security alerts in your Google and Samsung accounts, and check whether a work or school administrator manages the phone. Don’t assume Samsung itself randomly deleted the files without first checking those possibilities.
I’ll check the account activity and change my passwords first. I hadn’t realized a phone could be erased remotely through the account.