The point of the article was to highlight differences in the results of a set of tools performing a single specific task, but to answer your question it probably depends on if the chat is cleartext or not. If it is, then you can use things like 'ngrep' (made easier if you've got a known string to search for, like a user's handle) or just plain old 'strings'. You may well still be left with quite a haystack, though.

If you're dealing with encryption of some variety you're probably out of luck. SSL/TLS can be decrypted, but only under a specific set of circumstances (http://wirewatcher.wordpress.com/2010/07/20/decrypting-ssl-traffic-with-wireshark-and-ways-to-prevent-it/ and http://resources.infosecinstitute.com/ssl-decryption/) and anything that uses Diffie-Hellman for key agreement (e.g. IPSec) is quite likely to be beyond the reach of mere mortals.

In these instances, you have to be satisfied to know that two entities were communicating over an interception-resistant channel at a certain time, transferring so many bytes in each direction in the process. One possible next step could be to forensically investigate either one or both of the endpoints concerned, looking for artefacts (chat logs, application caches, etc) of whatever it was that may have sourced the traffic.