Chats, groups & recalls
Available messages, group events, quoted content, recalls, attachments and account identifiers reconstructed in chronology.
Messaging application evidence
WeChat
Forensics.
Detailed examination of WeChat conversations, media, contacts, payments, social activity, computer clients and mini-program artefacts where available.
Discuss a deviceExamination
What we can
establish.
Every instruction begins with the questions to be answered. Available evidence depends on the device, software, state, credentials, backups and prior handling.
Payments & transfers
Available transfers, red packets, merchant records and transaction artefacts examined alongside the conversations that give them context.
Contacts & identity
WeChat IDs, aliases, profile data, contact changes and group membership assessed carefully; a displayed name alone does not prove attribution.
Moments & favourites
Available Moments, comments, likes, favourites, channels and shared content examined where relevant to the questions instructed.
Desktop & backup sources
Windows or macOS client data, migration records, backups and other authorised sources considered where the handset record is incomplete.
Mini-program evidence
Cached data, usage artefacts, files and account interactions from mini-program activity identified and interpreted where technically available.
Evidence source map
Beyond the
visible application.
Absence from one screen or device does not resolve the evidential question. Relevant records may be distributed across several sources.
Local records
Accessible encrypted databases, media, contact identifiers, payment-related traces and migration records.
Backup and account
Do not assume a general provider-held chat archive. Assess existing desktop backups and migration copies.
Existing linked endpoints
Existing Windows or macOS clients and retained backup material; completeness varies.
Limits and corroboration
Recall events do not prove recalled wording. Payment traces are not a complete bank ledger. Lawfully obtained counterpart records may corroborate the source.
Evidential perspective
WeChat is an ecosystem, not just a chat application.
Relevant evidence may span messaging, payments, social content, files, computer clients and embedded services. Interpretation requires correlation between sources, attention to regional versions and a clear statement of what was, and was not, available.
Preserve now
Protect the
best evidence.
- 01Do not reset, update, reinstall or casually browse the application.
- 02Record the device, lock, power and network state.
- 03Identify backups, linked computers and counterpart devices promptly.
- 04Secure known credentials separately and maintain custody records.
Typical deliverables
Acquisition record
Device details, condition, method, tool, integrity information and material acquisition limitations.
Evidence schedule
Relevant conversations, attachments, timestamps, identifiers and supporting artefacts in a reviewable form.
Findings report
Plain-English findings with source references, alternative explanations and express evidential limitations.
Our approach
Proportionate.
Documented.
Explainable.
- 01Authority, objectives and device state confirmed.
- 02Acquisition method selected to preserve the best available evidence.
- 03Findings correlated and tested against alternative explanations.
- 04Clear reporting of methodology, findings and limitations.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
