The object of the study is a specific information structure — the dark net — and forensic aspects of its study during the investigation. The paper gives a brief overview of the features of the Internet layers: Cleernet, Deepnet and Darknet. Taking into account the specifics of the dark net, the complexity of investigating crimes committed with its use is stated. An approximate list of crimes committed through the dark net is determined. The existence of two main software systems for working in the dark net is indicated: 2IP and TOR. The author, when considering the specifics of the work of 2IP as a peer-to-peer network, states that without undercover work, becoming a network users or external hacking are practically impossible. The paper briefly outlines the principle of TOR (The Onion Router) operation, the features of multi-level encryption and the danger of imposing responsibility on the owner of the route exit node. The author suggests implementing operation and search, forensic and software measures to deanonymize users for the investigation purpose.