Recently an Internet security company (Avast) bought some used android from eBay and manged to retrieve loads of data even after a factory reset!
Here are 2 must do steps before you sell the android device.
1. Go to settings -> security -> encrypt device.
2. Do factory reset.
In this way, the data get encrypted into meaningless bytes without the encryption key.
More details from this cnet article.
The best way to completely wipe your Android device.
by Dan Graziano
