I have a work phone which I use as my personal phone also. So there is a lot of stuff like personal photos co-existing on the device.

When I return the phone I want to know that the next IT person that get's the phone will not be able to run a file recovery utility over the device and gain ownership of my potentially confidential files.

So how to do that. This site has an eloquent answer Galaxy S4 Secure File Deletion. The basic process is

1. Encrypt the device (Both the phone and the SD Card)
2. Then perform a Factory reset

When you reset the device the encrypted files, while possibly still on the become totally unavailable to the next user. It' probably as good as deleting and zero-ing the freespace except you can do it with software on the phone.

Before doing the above process it's a good idea to backup the phone. I used AndSMB to grab all my downloads and photos and put them onto a Windows Share.