Deleted WeChat Messages — Can Chinese Police Recover Them?

A question asked again and again

“I deleted my WeChat chats — can the police still recover them?” This comes up constantly in consultations. Online answers tend towards two extremes: “once deleted, nothing can be found” or “the technology is so good they can dig up messages deleted ten years ago”.

Whether recovery is possible is half a technical question and half a question of legal procedure. As a lawyer, what I can explain is the latter — the conditions and procedures the law sets for “recovery”. Whether records on a particular phone can ultimately be read is for technicians to judge on the specific device.

First distinguish two things: records on the server and records on your phone

Many people confuse the two. Tencent has stated publicly that WeChat chat records are used only for local search and display on the phone, and that “no one’s chat records can be extracted from the WeChat server back end”. In other words, there is generally no route of “having the platform pull up both sides’ chat content”.

But the platform isn’t empty-handed. Account registration information, login times and IP addresses, payment and transfer records and login logs are all “electronic data” in law. Article 1 of the Supreme People’s Court, Supreme People’s Procuratorate and Ministry of Public Security Provisions on Collecting, Extracting, Reviewing and Judging Electronic Data in Criminal Cases (法发〔2016〕22号) lists electronic data including “communications information of network application services such as text messages, email, instant messaging and group chats” and “user registration information, identity authentication information, electronic transaction records, communication records and login logs”. Such information can lawfully be obtained from the platform by investigators.

To be clear: that chat content isn’t kept on the server is Tencent’s public statement (quoted, not my inference); what data a platform actually retains and can provide in a specific case is a matter of practice and can’t be generalised.

Can data deleted on a phone be technically recovered?

The common view is that on iPhones deleted data is basically unrecoverable, while on Android phones recently deleted data not yet overwritten has a chance of recovery. That is broadly in line with technical common sense, but it’s technical experience, not a legal conclusion — recovery depends on when data was deleted, whether it has been overwritten repeatedly, whether the device is encrypted, and whether there are local or cloud backups.

More importantly, in criminal cases, once a device is seized, whether data recovery is attempted is not up to the holder but the investigators — the law expressly makes “recovery” a statutory examination method.

“Data recovery” is an examination method written into law

Two documents are used most:

• Article 16 of 法发〔2016〕22号: “Seized original storage media or extracted electronic data may be examined by recovery, cracking, statistics, correlation, comparison and other methods. Investigative experiments may be conducted when necessary.”
• Article 43 of the Rules on Electronic Data Forensics by Public Security Organs in Criminal Cases (公通字〔2018〕41号, issued 13 December 2018, in force 1 February 2019): “Where seized original storage media or extracted electronic data need to be examined by data recovery, cracking, searching, emulation, correlation, statistics, comparison and other methods to further discover and extract case-related leads and evidence, an electronic data examination may be conducted.”

So recovering deleted chats is not some technique beyond legal authority but an evidence-gathering step with a clear basis. “Once deleted it can’t be found” is a matter of luck, not a right.

But “can recover” doesn’t mean “can recover any way they like”

The Electronic Data Forensics Rules impose a series of requirements on the examination — and these are exactly what can be checked afterwards:

• Who does it — Article 44: examinations shall be carried out by two or more investigators with technical expertise; people with specialist knowledge may be assigned or engaged when necessary.
• How the device is accessed — Article 47: through a write-blocking device, or by examining a backup; where neither is possible, the reason shall be noted and the whole process video-recorded.
• Leaving a record — Article 48: an Electronic Data Examination Record shall be made, stating start and end times, personnel, object, purpose, tools, methods and steps, and results.
• Checking on transfer — Article 46: when electronic data is transferred within the police, the integrity hash value and sealing photos shall be checked for consistency; any mismatch shall be noted in the record.
• Complete seizure formalities — Articles 10–12: original storage media shall be seized and sealed with a record; phones and other devices with wireless functions shall also be signal-shielded, signal-blocked or powered off; and a Seizure List in triplicate shall be drawn up on the spot with a witness and the holder, one copy given to the holder.

Another route: not “recovery” but “obtaining from third parties”

Some information doesn’t require touching your phone. Article 41 of the same Rules provides that obtaining electronic data from relevant units and individuals requires approval by the head of the case-handling department and a Notice to Obtain Evidence. Account registration information, login logs and transfer records are usually obtained this way.

A higher threshold applies to technical investigation measures. Article 150 of the Criminal Procedure Law (2018 amendment) provides that after opening a case concerning crimes endangering national security, terrorism, organised crime, major drug crimes and similar, police may, where needed and with strict approval, use technical investigation measures; Article 152 requires confidentiality of personal privacy learned and prompt destruction of material unrelated to the case.

Three common myths

• Myth 1: “Deleted means gone.” Records may be recovered from the device, or the facts may be reconstructed from data obtained from third parties, witness statements, transfer records, surveillance and other evidence.
• Myth 2: “If police want to recover it, they always can.” Technical conditions such as deletion time, device type and encryption limit recovery; and evidence obtained in breach of procedure may not be usable as a basis for decision.
• Myth 3: “Once the phone is taken, they can go through it freely.” Seizure requires a Seizure List; examination requires a record, witnesses and video; hash values must match. Article 56 of the Criminal Procedure Law establishes the exclusionary rule; Article 71 of the Provisions on Procedures for Public Security Organs Handling Criminal Cases (as amended by MPS Order No. 159) further provides that where physical evidence, documents, audio-visual material or electronic data are collected in breach of statutory procedure in a way that may seriously affect judicial fairness, the defect shall be cured or reasonably explained; if not, the evidence shall be excluded.

A case in the People’s Court Case Database, Zhu et al., fraud (Database No. 2024-04-1-222-011; Sichuan High People’s Court (2021) Chuan Xing Zhong No. 482), holds that in cross-border telecom fraud cases the authenticity and integrity of electronic data should be determined by reviewing the seizure or sealing status of the original storage media, the collection and extraction process, the integrity hash values, and access logs after freezing. Sealing status and hash values are thus exactly where scrutiny can focus in practice.

If someone has actually been investigated, what can the family do?

• Remember the timeline: when the device was seized, what was taken, who was present, whether there was a witness.
• Ask for documents: a copy of the Seizure List should be given to the holder; check whether it was issued and whether it matches what was actually seized.
• Watch the sealing status: photos of seals, whether signals were blocked or the phone powered off, whether it could be switched on after sealing — these details affect findings on authenticity.
• Check hash values: whether the examination record states integrity hash values; if they don’t match on transfer, ask for an explanation.
• Seek exclusion for procedural violations: the defense lawyer can raise exclusion at the investigation, prosecution and trial stages (Criminal Procedure Law Art. 56(2)).

In civil cases, do the opposite

In civil disputes (loans, payment for goods, leases, marital property), the logic is reversed: you should actively preserve WeChat records so you can use them. Article 14 of the Supreme People’s Court Several Provisions on Evidence in Civil Procedure lists “communications information of network application services such as instant messaging and group chats” as electronic data; Article 15 provides that a party relying on electronic data shall provide the original, and copies made by the creator consistent with the original, or printouts or other displayable output directly derived from the data, are treated as originals. So don’t rely only on screenshots or forwarded images; keep the original conversation and, where necessary, notarise it or use trusted evidence preservation.

Conclusion

Whether to delete records is a personal choice, but whether deletion is “definitely safe” shouldn’t be judged by rumour. Police data recovery has a legal basis and procedural thresholds; what really decides a case is usually not how many messages were deleted, but whether the evidence as a whole corroborates itself and whether it was lawfully obtained.

If you or your family face a phone seizure or electronic data being obtained, or have doubts about the authenticity or legality of electronic evidence, contact Wang Xin: phone +86 186-0113-9509, WeChat wang223040.

This is an English edition of Wang Xin’s original Chinese article, 微信聊天记录删掉了，警察还能恢复吗？. It explains the law of the People’s Republic of China in general terms and is not legal advice for any particular case; outcomes depend on the specific facts and on how local authorities apply the rules.