The direct answer is to audit who and what can reach each storage copy: the unlocked phone, individual apps, cloud accounts, computer backups, removable media, work profiles, and recovery channels. Remove unused access, narrow remaining permissions, and prove important data can still be recovered.
Inventory storage zones and owners
List internal device storage, photo library, downloads, app-specific files, secure folders, work profile, memory card, cloud photo service, cloud drive, device backup, and local computer backups. Record the account and person responsible for each. Do not assume all files shown on the phone are actually stored locally; some may be placeholders for synchronized cloud content.
Classify sensitive categories such as identification, health data, financial records, password exports, customer information, private photos, and authenticator backups. This helps prioritize access removal and prevents a capacity-only review from missing a small but critical file.
Review app permissions
On Android, review apps by individual app and by permission category using Google's permission guide. Prefer a system file or photo picker for occasional access instead of broad library access. On iPhone, Apple's app privacy controls let users review and change categories such as Photos, Files, camera, microphone, and location.
For every broad permission, write the feature that needs it and the last successful test. Revoke permissions from unused apps, old scanners, file cleaners, media editors, and chat tools that no longer need them. After revocation, open the app and verify unrelated features still work.
Audit people, accounts, and machines
Check phone unlock methods, enrolled biometrics, device administrators, family or organization management, cloud account sessions, shared albums, shared folders, connected computers, backup passwords, and recovery contacts. Remove former devices and people. Change credentials if a departed user or vendor could have known them.
For work data, confirm the work profile and management controls are active and separate from personal apps. NIST SP 800-124 Rev. 2, mobile-device security guidance, covers both organization-provided and personally owned devices and recommends lifecycle controls including stored-data protection and secure wiping.
Check backup and removable-media access
Verify the backup account, encryption setting, last successful time, restore authority, and retention. A person who can reset the cloud account may effectively control the backup even without the phone. For computer backups, review the computer's user accounts and disk protection. For removable storage, determine whether another device can read it and whether files remain after the card leaves the phone.
Use a harmless sample to test export and restore. Do not erase the only copy. Record where a deleted test file persists in trash, sync history, or backup. Permission removal on the phone does not revoke access already granted to a shared cloud folder.
Verify retirement and incident controls
Confirm the owner can remotely locate or erase the phone where supported and that recovery contacts are current. Document the procedure for a lost device, repair, employee departure, or resale. Before transfer or retirement, back up required records, sign out of accounts, use the supported factory erase, remove the device from management, and verify the next owner cannot reach prior data.
Record the result
Keep the storage zone, app or person, access level, purpose, owner, test, remediation, and next review date. Do not include passwords or recovery keys. Repeat the audit after installing a storage utility, adding a work account, changing backup providers, or replacing the phone.
A good audit leaves no unexplained broad permission, no forgotten shared copy, and no critical backup controlled by an unknown or former account.
Sources
- Change app permissions on your Android phone — Google Android Help
- Control access to information in apps on iPhone — Apple Support
- Guidelines for Managing the Security of Mobile Devices in the Enterprise — National Institute of Standards and Technology, May 1, 2023