[opportune]

Correct, for data that isn't backed up, you would need to have root access to the user's device.

[chii]

i do believe rubber-hose decryption works wonders in china.

[xvector]

Not even root access would suffice. You'd need the user passcode.