Ste6 wrote:
I’m not sure I’m just thinking about old emails / chats / photos that haven’t been deleted but not over written
Follow the Apple procedures. They work, and are usually appropriate and will work for most of us.
If the security provided by the Apple procedures is deemed insufficient for your needs and expectations, you are left to physically destroy the iPhone. Physical destruction including melting down or shredding will greatly reduce the chances of unauthorized data disclosure.
Flash storage (SSDs, NVMe, USB flash devices, etc) works completely differently from how hard disks work. There is no overwrite function with flash storage, particularly given most devices include wear leveling support. Wear leveling distributes the data writes in an effort to avoid having specific areas of the flash repeatedly overwritten, causing degradation and failure in those storage areas. That wear leveling then means you can’t overwrite what was written, short of overwriting everything including all of the over-provisioned storage.
Flash storage inherently needs to be erased before the same storage can be reused, which means reloading an iPhone does very well at rendering its contents inaccessible. The erase is slow, so most flash storage devices process the erasure as quickly as they can (see “TRIM”), utilizing underlying mechanisms related to the wear leveling support. This for two separate reasons: the storage is erased and reused during the reload, and (most importantly) the iPhone data encryption keys are changed meaning that the encrypted data is encrypted and undecryptable and inaccessible.
Short answer: follow what your site security officer or IT group requires. If you have no security officer or IT group, follow what Apple suggests. If your data is exceedingly sensitive, shred and slag.