Conventional Neuro-Fuzzy is inapplicable for large-scale Network Forensics Readiness. Lower optimal size of Self-Organizing Map produces more generalized rules. The new fuzzy patches construction method uses χ2 test for parameter estimation. Modified Gaussian membership function better describes correlation in data. Proposed modifications can improve real-time forensically-sound evidence collection.