Ex-prosecutor says Chinese law enforcement unable to access WeChat history via Tencent

And she knows of no instance when an iPhone is cracked in China without a password.

The following is an April 28 blog post by 君宁观法 Jun Ning Guan Fa, which appears to be a personal blog by a Shanghai-based lawyer.

The writer self-identifies as Dan Ning, "a former senior prosecutor, with twelve years of experience handling criminal cases on the front line, once commended as an 'outstanding public prosecutor' by a province/provincial-level municipality, and currently a legal practitioner specializing in criminal defense for over ten years."

Upon further research, she appears to be a lawyer at Yingke, one of China's well-known law firms, although she doesn’t disclose it in the blog.

My point in giving you this background is that the blog appears to share that author's knowledge and experience in criminal law so that, frankly, she can get more business.

What caught my eye is that, contrary to popular perception, the prosecutor-turned-lawyer reports that, based on her decade-long prosecutorial experience and interactions with dozens of prosecutors across China, they have never been able to retrieve WeChat records from Tencent, the popular messaging app's owner, headquartered in Shenzhen, Guangdong Province.

WeChat is so dominant in Chinese mainland communications nowadays that it is practically more important than phone calls, text messages, and everything else combined.

She also reports that in Chinese law enforcement, it's typically very difficult to access smartphones without a password, and she knows of no instance where an iPhone was cracked without a password in China.

Believe it or not - most of you won't, let's be honest, and with good reason, I just think it's just a very interesting piece.

已删除的聊天记录有多少能被提取出来

How much of deleted chat history can be extracted

Chat records on smartphones are a form of electronic data and are often used as evidence in criminal cases. There are various opinions circulating online regarding whether deleted WeChat chat records can still be retrieved, with some believing they can be extracted from Tencent’s (hereinafter referred to as a certain company) backend, some think they cannot be retrieved without the phone password, others think that it’s possible to retrieve those within five years, some believe only text can be recovered while voice messages cannot, and others think that once the phone is lost, the data cannot be retrieved.

I used to be a prosecutor, and during my twelve years in grassroots prosecution, I was always on the front line handling cases, often using the mobile phone electronic data of suspected individuals as evidence. So today, from the perspective of case handling practice, I will talk about the actual situation of electronic data recovery and extraction.

1. Deleted electronic data is recovered directly from the phone, not from the backend of a certain company.

Many people believe that deleted WeChat chat records are extracted from the backend storage of the certain company. However, in all the cases I handled as a prosecutor, no one ever obtained data from the backend of the certain company. There were a few times when we communicated with the public security organs (police) about whether data could be extracted from the backend of a certain company, and we even issued an introduction letter to the company, but ultimately, we did not obtain any data. Additionally, during the annual off-duty training organized by the Supreme People’s Procuratorate, prosecutors from various provinces and municipalities gather for classes. In a training session I attended, there was a course on electronic data. According to feedback from participants, all the data was recovered directly from the phones, and no one had obtained data from the backend of a certain company. Therefore, I believe that the possibility of obtaining deleted information from the backend of the certain company in practice is very low. In practice, the carrier of mobile phone electronic data used as evidence is still the phone itself, not the storage device of the certain company’s backend. Of course, if someone has seen data being retrieved from the backend of a certain company after a phone was lost, or seen an investigation agency issue an “Evidence Retrieval Notice” to the company to retrieve electronic data, or has seen a report of electronic data originating from a certain company, they can leave a comment in the comment section at the end of this article.

2. Deleted WeChat chat records can be recovered directly from the phone, within the range specified by the investigation/prosecution personnel.

Once the phone is submitted to the technical department by the investigation/prosecution personnel handling the case, the technical department does not simply recover everything all at once; instead, the scope is specified by the investigation/prosecution personnel. Based on common chat habits, the most frequently recovered data is the WeChat chat history during the time period related to the case. Other data, such as QQ chats, text messages, call records, taxi records, purchase records, or other chat software content, are not typically included in the usual recovery scope.

3. The completeness of recovered and extracted electronic data is uncertain.

This might be related to the following factors:

(1) The usage status of the phone.

In general, the earlier the information was deleted, the lower the possibility of recovery. The later the information is stored, the more information is likely to be recovered.

(2) The setup of the technical department and the qualifications of the technical personnel.

This is crucial for evidence collection. Both public security organs (police) and prosecutors can recover and extract electronic data, but the technical facilities and personnel available vary across regions, as does the rigor of the process. For example, some regions may have only higher-level public security departments capable of performing such tasks, requiring strict approval procedures. As a result, when a case is transferred to the prosecution, prosecutors may find that the extracted content is incomplete and may wish to send it back to the public security organs for a broader scope of recovery, but the complicated procedures often lead to abandonment of this idea. In contrast, in some regions, the prosecutor’s office has its own specialized technical department, and if the transferred electronic evidence is found to be incomplete, the prosecutor can directly hand it over to the colleagues in the technical department for extraction, ensuring efficient collaboration and more complete recovery of data.

(3) The thoroughness of the case handler.

Since the data recovered by the technical department is often extensive, sometimes covering several years, the investigation/prosecution personnel handling the case must sift through a massive amount of data to find useful information. The thoroughness of the case handler also determines the completeness of the data used to prove the case.

4. If the phone password is not provided, it is difficult to extract data, but it is occasionally possible.

It is difficult to perform data recovery without the phone password. However, there was an instance where a technician successfully unlocked an Android phone and extracted data without the password, but no such success was achieved with an iPhone.

5. What content from WeChat chat records can be recovered and extracted?

WeChat chat messages, including text, emojis, voice messages, pictures, documents, group chats, and friend addition or deletion records, can all be recovered, except for voice calls. Voice calls can be recovered to the extent that there is a call record, but the actual content of the calls cannot be retrieved. As a lawyer, when using these electronic data as evidence, it is important to carefully review the case file, even though there may be obstacles in practice. However, according to the Criminal Procedure Law, as long as the data is used as evidence, lawyers do have the right to review the file.

6. If the phone is lost, does that mean the electronic data cannot be extracted?

The loss of the phone only means that the electronic data from that specific phone cannot be retrieved, but it does not mean that all electronic data containing that information is irretrievable. For example, the phone of the information recipient can be located, and the relevant chat records can be extracted from it. Additionally, if the phone had been logged into a computer or tablet, the corresponding data might still be stored on those devices and can be extracted. Therefore, lawyers often find screenshots of WeChat chat records from the information recipient’s phone in the case files, which were extracted from that phone. Although screenshots of WeChat chat records do not conform to the 《公安机关办理刑事案件电子数据取证规则》 “Rules for Evidence Collection of Electronic Data in Criminal Cases” and the 《关于办理刑事案件收集提取和审查判断电子数据若干问题的规定》“Regulations on Collecting, Extracting, and Reviewing Electronic Data in Criminal Cases,” they are generally accepted by courts as material that can prove the facts of the case.