Thinking of upgrading your cellphone? Better make sure it's clean before you trade up.

Ontrack, the world’s largest data recovery company, purchased 25 phones through eBay, Facebook Marketplace and other online phone resellers. Of the 25 phones, they found three with potentially damaging personal information.

Engineer Steve Hruska points out some of what was left on the devices.

“So, here we have his Hotmail account. I can request a password reset, I can set it to whatever I want,” he says. “There is a lot of damage I can do on this phone.”

And the treasure trove for an identity thief extends way beyond an email account. Ontrack has found text messages, contacts, emails, paystubs, banking apps, Facebook accounts that are still logged in, passwords saved in a notes app and even some very personal photos.

One person in the Ontrack experiment sold their phone with nude pictures of themselves and others.

The good news is that 22 of the 25 phones had the data completely wiped and inaccessible. All the phones bought from companies that specialize in refurbishing phones were properly erased.