At the time of the two users' arrests, the Kyoto Police claimed to have "analyzed Winny's anonymity features" to track the users down, but did not disclose the exact method used.
After failing to crack Winny's encrypted communications used in its file sharing feature, the Kyoto Police switched to a different method, namely tracking users via Winny's integrated forum feature.