Abstract: Objective Instant messaging chat records are important evidence for electronic data forensic appraisal, and their authenticity appraisal often becomes the focus of litigation. In forensic appraisal practice, the existence appraisal of instant messaging chat records is mostly conducted, and the authenticity appraisal is notably absent. Developing methods for verifying the authenticity of chat records can address the current difficulties and pain points in electronic data authentication. Methods This article combines the practice of electronic data forensic appraisal, mainly using QQ and WeChat running on iOS and Android systems as sample materials, to conduct research on the authenticity appraisal technology of chat records, specifically targeting methods to detect and counteract “perfectly forged” chat records. Results By analyzing the operating mechanisms of different versions of instant messaging tools running on different models, iOS and Android devices, a technology for mutually verifying the authenticity or forgery of chat records using operating systems, file systems, and chat record databases was proposed, and an operational method for verifying the authenticity of chat records was summarized. Conclusion Through the “three-dimensional” authenticity appraisal technology of operating systems, file systems, and chat record databases, the authenticity of chat records in instant messaging tools can be accurately determined, and the possibility of forgery can be determined or eliminated, filling the gap in the authenticity appraisal technology for chat records. This holds important theoretical research significance and judicial practical application value for authenticity appraisal.

Key words: instant messaging, forgery of chat record, authenticity appraisal

摘要： 目的 即时通讯聊天记录是电子数据司法鉴定的重要证据，其真实性鉴定往往是诉讼中的焦点。司法鉴定实践大多为即时通讯聊天记录的存在性鉴定，缺少真实性鉴定的案例。探索聊天记录真实性鉴定方法可以解决当前电子数据鉴定的难点、痛点。方法 结合电子数据司法鉴定实务，主要以运行在iOS和Android系统的QQ和微信即时通讯工具为检材样本，开展了聊天记录真实性鉴定技术研究。研究对抗和甄别“完美伪造”聊天记录的方法和技巧。结果 通过对运行在iOS和Android不同型号设备上的不同版本即时通讯工具的运行机制进行分析，提出利用操作系统、文件系统和聊天记录数据库的互相验证聊天记录真实或伪造的技术，总结出具有操作性的聊天记录真实性鉴定方法。结论 通过操作系统、文件系统和聊天记录数据库 “三维”真实性鉴定技术，可以准确判断出即时通讯工具的聊天记录真实性，确定或者排除伪造的可能性，填补聊天记录真实性的鉴定技术空白，对于真实性鉴定有着重要的理论研究意义和司法实践应用价值。

关键词: 即时通讯, 伪造聊天记录, 真实性鉴定