The paper examines an instant messenger as a generation environment and a carrier of information of forensic significance. It has been shown that instant messaging correspondence constitutes a collection of heterogeneous objects, which necessitates the application of a complex of specialized knowledge during their analysis. The central problem is defined as the gap between the actual capabilities of criminals to conceal their identities and destroy digital traces, on the one hand, and the limited procedural and methodological mechanisms for identifying account holders and ensuring the authenticity of electronic communications, on the other. A model is proposed for establishing the "attribution of a chat (correspondence)" to a specific individual.