Contract analysis

I. Executive Summary Brindoval Digital Forensics LLC ("Brindoval"), the neutral forensic examiner appointed by stipulation of the parties on March 8, 2023 and approved by the Honorable David Rutherford, Superior Court of the State of California, County of Santa Clara, issued its Preliminary Forensic Report on May 1, 2023 (the "Report"). The purpose of this memorandum is to provide the litigation team with a comprehen

1. LumosEdge Ensemble ML Model Architecture — including neural-network topology definitions, hyperparameter configuration files, and signal-generation engine specifications;

2. Proprietary Feature-Engineering Libraries — encompassing 2,847 individually engineered features used for financial signal generation, documented in Jupyter notebook format;

3. DataStream ETL Pipeline Codebase and Data-Schema Definitions — the proprietary extract, transform, and load pipeline covering ingestion protocols and data-schema definitions for all 43 alternative-data vendors integrated into the Lumos platform;

4. Curated Training Dataset — the approximately 14.6 terabyte training dataset developed by Lumos over a period of more than four years at a cost exceeding $7.3 million (as alleged in the Verified Complaint); and

5. Confidential LumosEdge 3.0 Product Roadmap Documents — a 37-page internal strategy document detailing unreleased product specifications, planned features, and development milestones for the period 2023 through 2025. As discussed in greater detail below, the forensic evidence not only confirms that Lumos's proprietary materials were taken by the individual defendants prior to their departures from Lumos, but also d

II. Scope of Forensic Examination A. Devices and Systems Imaged Pursuant to the terms of the March 8, 2023 Stipulation and Order Regarding Forensic Examination (the "Stipulation"), Brindoval was authorized to image and examine the following devices, systems, and accounts. The Report confirms that all of the following were successfully imaged and examined during the examination period:

1. NovaSpark Corporate Servers. Brindoval imaged the NovaSpark corporate server environment located at NovaSpark's offices at 88 Bluxome Street, Floor 4, San Francisco, California 94107. The corporate server environment included NovaSpark's primary development server, a staging server, and associated network-attached storage. The total volume of data imaged from the corporate servers was approximately 4.7 terabytes.

2. Personal Laptops. Brindoval imaged three personal laptops belonging to each of the individual defendants: (a) Rajiv Anand — Tidewater Industries MacBook Pro, 16-inch, 2021 model (Serial No. C02GR3XXXXX); (b) Serena Mallick — Brightmoor Group XPS 15, 2020 model (Service Tag: HGRT7XXXXX); and (c) Derek Yun — Tidewater Industries MacBook Pro, 14-inch, 2021 model (Serial No. C02HK8XXXXX).

3. Personal Smartphones. Brindoval imaged two personal smartphones: (a) Rajiv Anand — Ashbury Corporation 14 Pro (IMEI: 35491XXXXXXXXX); and (b) Serena Mallick — Northgate & Co. Galaxy S22 (IMEI: 35287XXXXXXXXX). The Report notes that Derek Yun represented, through counsel, that he did not use a personal smartphone for work-related communications during the relevant period and that his only smartphone was replaced an

4. External Storage Drives. Brindoval imaged two external storage drives: (a) Glenrock Industries external USB hard drive, serial number WD-4837291, identified as belonging to Serena Mallick; and (b) Beaumont Solutions portable SSD, serial number S5NENS0XXXXX, identified as belonging to Rajiv Anand. The Report notes this drive was largely empty at the time of imaging, with evidence of recent formatting, but residual

5. Cloud Storage Accounts. Brindoval obtained and examined data from the following cloud storage accounts: (a) Rajiv Anand's personal Hollowell Health IT account (email address: r.anand.personal@vaultmail.com); (b) Derek Yun's personal Larkspur Technologies account (email address: d.yun.private@Greaves Systems.com); and (c) NovaSpark's corporate cloud repositories, including a Tidewater Solutions organization account

1. Forensic Imaging. All devices and storage media were imaged using industry-standard bit-for-bit imaging protocols, specifically using the Calderon Technologies and Stonefield Software imaging tools. Each forensic image was verified against the original media using SHA-256 hash verification to ensure data integrity. Chain of custody was maintained throughout the imaging and examination process in accordance with th

2. File-Matching Analysis. The core of Brindoval's analysis involved SHA-256 hash-value comparison of files found on Defendants' devices and systems against Lumos-provided reference copies of its proprietary materials. Lumos provided Brindoval with a reference set of proprietary files on March 20, 2023, two days prior to the commencement of the examination, in accordance with the timeline set forth in the Stipulation

3. Timestamp and Metadata Analysis. Brindoval conducted detailed analysis of file creation dates, modification dates, and last-access dates for all files of interest. Metadata embedded within the files—including authorship information, internal directory paths, project tags, and version-control metadata—was also analyzed. This analysis was critical to establishing the timeline of exfiltration events and the subsequen

4. Transfer and Connection Log Analysis. Brindoval analyzed file-transfer logs, browser download histories, USB device-connection logs (from both Lumos-issued and personal devices), and cloud synchronization records to reconstruct the methods and timing of data transfers. This analysis included examination of Windows Event Logs, macOS Unified Logs, and application-specific logs for Hollowell Health IT, Larkspur Techn

5. Email and Messaging Artifact Recovery. Brindoval recovered email artifacts from personal devices, including locally cached email messages, and messaging application records from personal smartphones. The messaging artifacts included text messages (SMS and Westmark Software) and records from the signal encrypted messaging application. The Report notes that while signal message content was recoverable in certain ins

III. Key Findings — Rajiv Anand Rajiv Anand served as Vice President of Machine Learning at Lumos from June 2019 through his resignation on October 14, 2022. In his role, Anand had broad access to the LumosEdge model architecture, training datasets, and product strategy materials. He subsequently joined NovaSpark as its Co-Founder and Chief Technology Officer. The forensic evidence pertaining to Anand is among the mo

IV. Key Findings — Serena Mallick Serena Mallick served as a Senior Data Engineer at Lumos from March 2020 through her resignation on October 14, 2022 (the same date as Anand's resignation—a coincidence that the coordination evidence discussed in Section VI below reveals was not coincidental at all). In her role, Mallick was the primary architect and lead developer of the DataStream ETL pipeline, Lumos's proprietary

V. Key Findings — Derek Yun Derek Yun served as a Machine Learning Engineer at Lumos from January 2021 through his resignation on October 21, 2022. In his role, Yun was responsible for developing and maintaining Lumos's proprietary feature-engineering libraries—the extensive collection of engineered features used to transform raw alternative data into predictive signals for the LumosEdge platform. He subsequently joi

VI. Cross-Referencing and Coordination Evidence Perhaps the most damaging category of evidence identified in the Report—from the perspective of Defendants' potential defenses—is the coordination evidence recovered from the personal smartphones of Rajiv Anand and Serena Mallick. This evidence transforms the narrative from one of three potentially independent acts of misappropriation into a single, coordinated scheme o

VII. Summary of Proprietary Material Categories Found on Defendants' Systems The following table summarizes, by trade-secret category, where Lumos proprietary materials were identified by Brindoval during the forensic examination: Several observations merit emphasis based on this summary: First, the division of exfiltrated materials maps precisely to each defendant's area of expertise and responsibility at Lumos: Ana

VIII. Meridian Cybersecurity Advisors — Independent Assessment Naveen Kapoor, Senior Consultant at Meridian Cybersecurity Advisors Inc. (located at 2100 Geng Road, Suite 210, Palo Alto, California 94303), independently reviewed the Brindoval Report and the underlying forensic images pursuant to Meridian's engagement by Calderwood & Harkness on behalf of Lumos. Kapoor holds a Master of Science in Computer Science from

1. Validation of Methodology. Kapoor confirms that Brindoval's file-matching methodology is sound and consistent with industry best practices for digital forensic examination. The use of SHA-256 hash-value comparison is the accepted standard for file-identity verification in forensic contexts, and Brindoval's implementation of that methodology, as described in the Report, is technically rigorous.

2. Reliability of Hash-Value Comparisons. Kapoor confirms that the hash-value comparisons reported by Brindoval are reliable and that the matched files are, with mathematical certainty, identical to the Lumos originals. There is no reasonable basis to challenge the accuracy of the file-matching results.

3. Consistency of Timestamp Evidence. Kapoor confirms that the timestamp evidence presented in the Report is internally consistent. The file creation dates, modification dates, sync timestamps, and device-connection logs all corroborate one another and are consistent with the exfiltration timeline described in the Report. Kapoor found no evidence of timestamp manipulation or inconsistencies that would undermine the r

4. Supplemental Code-Comparison Analysis. Kapoor conducted a detailed supplemental code-comparison analysis on the modified DataStream ETL pipeline files found on NovaSpark's corporate development servers. This analysis employed both automated comparison tools (including structural code-similarity analysis using abstract syntax tree comparison) and manual expert review. Kapoor's conclusions are unequivocal: the modif

5. Lumos-Specific Internal Identifiers on NovaSpark Systems. Kapoor's analysis further identified an additional category of evidence not specifically highlighted in the Brindoval Report. Certain NovaSpark development logs—including build logs, test execution records, and developer commit messages within NovaSpark's version-control system—reference Lumos-specific internal identifiers. These include: (a) Internal proje

IX. Implications for Litigation Strategy A. Strengthening of Claims The forensic evidence documented in the Brindoval Report and corroborated by Meridian's independent analysis strongly supports all five causes of action set forth in the Verified Complaint filed on January 18, 2023: (1) Trade Secret Misappropriation under the California Uniform Trade Secrets Act (Cal. Civ. Code §§ 3426–3426.11). The Report provides d

X. Recommended Next Steps Based on the foregoing analysis, I recommend the following actions:

1. Circulate this memorandum to the full litigation team, consisting of Marcus Delgado (Responsible Partner), Catherine Bloom (Billing Partner), Wendy Schultz (Lead Associate), and Omar Siddiqui (Working Associate). Distribution should be limited to these individuals and should not extend beyond the litigation team without prior authorization from Mr. Delgado, consistent with the privilege and confidentiality protect

2. Schedule an internal case-strategy meeting to prepare detailed deposition outlines incorporating the forensic findings from the Brindoval Report. Given that the Anand deposition is scheduled for May 15, 2023, this meeting should be convened no later than May 10, 2023. I will circulate preliminary deposition outlines for each defendant in advance of the meeting.

3. Coordinate with Naveen Kapoor of Meridian Cybersecurity Advisors to finalize the supplemental technical analysis (Appendix B) for use in depositions. We should confirm Kapoor's availability to assist with deposition preparation and, if necessary, to attend depositions in a consulting capacity. We should also discuss with Kapoor the scope and timeline for a formal expert report if expert testimony will be required

4. Prepare a client update letter for Lumos, addressed to Priya Chandrasekaran (CEO) and Thomas Brightwell (General Counsel), summarizing the forensic findings at an appropriate level of detail. The client letter should be mindful of privilege and confidentiality designations, including the terms of the March 15, 2023 Protective Order governing the treatment of confidential discovery materials in this action. We shou

5. Evaluate whether to seek additional discovery based on the coordination evidence identified in the August–September 2022 messages recovered from Defendants' personal smartphones. In particular, we should consider: (a) Whether to serve additional written discovery on Defendants seeking all communications among the defendants and with third parties regarding the founding of NovaSpark, the acquisition of Lumos propri

XI. Appendices Referenced The following appendices are referenced in this memorandum. Copies are maintained in the Calderwood & Harkness matter file for Matter No. 1008-00005 and are available to authorized members of the litigation team. Appendix A: Brindoval Digital Forensics LLC, Preliminary Forensic Report (issued May 1, 2023). Full copy on file. The Report consists of 147 pages, including narrative analysis, for