The short answer
A detwer erase does not overwrite the phone's storage. It tells the iPhone or iPad to run its own Erase All Content and Settings, the same erase as Settings, General, Transfer or Reset. Everything on an iPhone is stored encrypted, and that erase destroys the key at the top of the encryption, so the data left on the chip can no longer be decrypted. Apple's words for the result are that it "renders all files cryptographically inaccessible".
What detwer adds is the record. Each erase is written to the device's timeline against its serial number: which computer ran it, when it started, each stage, and how it finished. That record is what an auditor or a customer will ask to see.
detwer's erase is not certified by any independent body today. This page sets out the mechanism, the standard it maps to, and the evidence, so you can judge it yourself.
What happens on an iPhone or iPad
Every file on an iPhone is encrypted with its own key. Those keys are wrapped by a key for the data volume, and that key is in turn protected by a key held in a small area of storage built to be wiped completely, which Apple calls Effaceable Storage. On iPhones from the A9 chip onward, the Secure Enclave's anti-replay system protects it as well.
Erase All Content and Settings deletes that top key. With it gone, every key below it is useless, and so is every file they protected. The erase is quick because it does not need to touch the data itself.
Apple documents the same key erasure whether the erase starts on the phone, from a device management (MDM) server, or from iCloud. detwer starts it from the Bridge app with the phone connected over USB, and it is the same erase.
Screenshot to come · Bridge app (Mac)
An iPhone connected to the Bridge, its row showing model, iOS version and the Erase button, with the confirmation sheet open ("Erase this iPhone? This cannot be undone").
public/erase/bridge-erase-confirm.png
Screenshot to come · Bridge app (Mac)
The same row mid-erase: the stage line and progress bar, then the device dropping off and coming back at the setup screen.
public/erase/bridge-erase-progress.png
Restore is a separate path
A restore puts a fresh copy of iOS on the phone from recovery mode, using firmware Apple has signed for that model. It is what you use when a phone will not start up, or when it needs to come back on a clean, current version of iOS before it is sold.
Apple describes a restore as securely erasing all content and settings and installing iOS. It does not describe the restore in the same key-by-key terms as Erase All Content and Settings, and the independent evaluation in the next sections covers the erase, not the restore. So detwer records the two separately: a device that was restored shows a restore on its timeline, not an erase, and the record says which one ran.
How this lines up with NIST SP 800-88
NIST SP 800-88 is the guideline most buyers name when they ask about data sanitisation. The current version is Revision 2, published in September 2025. Revision 1, which had a table listing iPhone's Erase All Content and Settings as a Purge method, was withdrawn on 26 September 2025, so that table should no longer be quoted.
Revision 2 accepts cryptographic erase as Purge, the level meant to stop a laboratory recovering data, when four conditions hold. This is how we read Apple's documentation against each one:
| NIST Rev. 2 condition | What Apple documents |
|---|---|
| No sensitive data was ever stored unencrypted | iPhone and iPad encrypt user data from first setup, and the encryption cannot be turned off. |
| Encryption of at least 128-bit strength | AES-256 per-file keys, wrapped by keys of the same strength. |
| Every copy of the target key is erased | The key in Effaceable Storage is deleted; from A9, anti-replay protection in the Secure Enclave prevents an old copy being restored. |
| No copy of the key is held anywhere else | Apple documents the key as generated and held on the device, and describes no copy kept anywhere else. |
On that reading, Erase All Content and Settings on a supported iPhone or iPad meets the Revision 2 conditions for Purge. This is our analysis. NIST does not certify or endorse products, and Apple has not published an 800-88 statement of its own.
What has been independently evaluated
Apple's wipe function has been through a Common Criteria evaluation by NIAP, the US scheme, against the Mobile Device Fundamentals protection profile. That profile includes a wipe requirement defined as "cryptographically erasing the encrypted DEKs or the KEKs". The certificate for iOS 18 was issued on 15 December 2025 and covers iPhones with the A13 chip or later (iPhone 11 onward) in a managed configuration. iPadOS 18 has its own certificate.
Two things follow. The certificate is Apple's, for Apple's software; it is not a certificate for detwer. And the evaluation of iOS 26 was still running in October 2026, so a phone on iOS 26 is covered by the same mechanism but not yet by a finished certificate. Apple's encryption modules also hold FIPS 140-3 validations; those cover the cryptography, not the erase.
What detwer checks and records
Every erase started from detwer is written to the device timeline as it happens, and kept:
- the device, keyed to its serial number, and the company it belongs to
- the computer the erase ran on
- the time it started, each stage with its time, and the time it finished
- whether the phone accepted the erase, or why it could not: not connected, not trusted, or failed
The erase record described below adds three checks:
- Setup screen reached. After the erase the phone restarts and drops off the cable. The record waits for it to come back, reads its serial again to confirm it is the same phone, and checks it is at its Hello screen. That shows the erase finished without an error; it is not a separate proof that the key was destroyed, which rests on the mechanism above. If any step is missing or does not match, no erase record is produced and the attempt stays on the timeline as failed.
- The person who started it and the version of the Bridge app that ran it.
- Activation Lock, on its own line. It matters for resale, because a phone still locked to someone's Apple Account cannot be set up by the next owner, but it says nothing about whether the data is gone, so it is never counted as part of the erase.
Screenshot to come · Dashboard (app.detwer.com), device page
One device timeline with the erase entry expanded: the computer it ran on, start and finish times, each stage with its time, and the result.
public/erase/dashboard-device-timeline.png
The erase record
A downloadable erase record for each device is in development. It will carry the fields NIST Revision 2 lists for a record of sanitisation (manufacturer, model, serial, method, technique, tool and version, verification, and the people involved), with a space for your own sign-off, because under Revision 2 the decision to accept an erase belongs to your organisation. It is detwer's own record of what was done, not a certificate from an independent body, and it will say so on its face.
Screenshot to come · Erase record PDF
Page one of a device erase record: device and serial block, method, detwer and Bridge versions, the checks after the erase (setup screen reached, Activation Lock state), operator, and the record ID linked to its online copy.
public/erase/erase-record-pdf.png
Our recovery testing
We test our own erase. On 21 October 2026 we put test files on an iPhone 17 Pro Max running iOS 27.0.1: two text files, a photo with a marker in its metadata, a copy of that photo in the camera roll folder, and a marked device name. Each held a random marker we could search for. Before erasing, we checked that our methods could find every item. We then erased the phone with detwer (Bridge 0.1.72), set it up again and ran the same methods.
We could not recover any of the test data with these methods. This is internal testing, not certification. The methods read only what the phone hands to a computer over USB; they cannot read the storage chip directly, so this result does not show that a forensic lab could recover nothing. More devices and iOS versions will be added here as we test them.
| Method | Before erase | After detwer erase |
|---|---|---|
| Pull of the phone's media folder over USB | all 4 files found (36 files read) | none found (31 files read) |
| Full local backup to a computer, two different backup programs | marked photo and device name found (about 1,770 files each) | none found (about 710 to 730 files each) |
| The phone's own device information | marked device name found | none found, name back to "iPhone" |
iPhone 17 Pro Max, iOS 27.0.1, 21 October 2026. Planted: 4 marked files and a marked device name.
Photo to come · iPhone, photo
The erased iPhone on its Hello screen beside the Bridge window showing the same device as erased. A photo, not a render.
public/erase/iphone-hello-screen.jpg
Android
detwer does not erase Android phones yet. On Android 10 and later, a factory data reset deletes the keys for the phone's file-based encryption, but how reliably it does so varies by manufacturer and by which reset is used. When Android erase arrives, this page will list the models it covers and what we know about each.
Limits
- detwer's erase is self-declared: this page, the per-device record and our own testing are the evidence. No independent body has certified it.
- The UK's National Cyber Security Centre treats a factory reset of an encrypted device as satisfactory for re-use or sale, and also says it cannot guarantee that a skilled, well-funded laboratory could recover nothing. The same is true of any erase that relies on cryptography.
- The analysis on this page applies to iPhone and iPad models with a Secure Enclave on a version of iOS that Apple still signs.
- Using detwer helps you meet your UK GDPR obligation to remove personal data before a device is passed on. It does not by itself make your business compliant.
Questions about anything here: support@detwer.com.
Sources
- Apple Platform Security Guide, Apple, August 2026 edition
- Restore an iPhone or iPad, Apple Platform Support, read 21 October 2026
- iOS security certifications, Apple, read 21 October 2026
- Apple iOS 18 Security Target, NIAP VID 11623, certified 15 December 2025
- NIST SP 800-88 Revision 2, Guidelines for Media Sanitization, NIST, September 2025
- SP 800-88 Rev. 2 FAQ, NIST, July 2026
- Secure sanitisation of storage media, NCSC, reviewed February 2025
- Android 16 Compatibility Definition Document, section 9.12, Google
detwer is not affiliated with or endorsed by Apple Inc. or Google LLC. iPhone and iPad are trademarks of Apple Inc., registered in the U.S. and other countries and regions. Android is a trademark of Google LLC. See also our Privacy Policy.