Contract analysis

I. QUALIFICATIONS AND BACKGROUND OF DECLARANT

1. My name is Dr. Rajiv Anand. I am the Engagement Lead of the Digital Forensics Division at Pinnacle Forensics LLC ("Pinnacle"), a nationally recognized digital forensics and electronic discovery consulting firm. My business address is 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910. I have held my current position at Pinnacle since 2018 and have been employed by Pinnacle in various capacities since 20

2. I hold a Doctor of Philosophy (Ph.D.) in Computer Science, with a specialization in digital forensics and information security, from the University of Maryland, College Park, which I received in 2009. I also hold a Master of Science in Computer Engineering from Virginia Polytechnic Institute and State University (Virginia Tech), conferred in 2005, and a Bachelor of Science in Electrical Engineering from the Georgi

3. Throughout my career, I have been retained as a forensic expert in approximately eighty-five (85) litigation matters in federal and state courts across the United States, as well as in arbitration proceedings. I have testified as a qualified expert witness on approximately thirty (30) occasions in federal and state courts, including on two prior occasions in the Delaware Court of Chancery. My expert testimony has

4. I was retained by Calderwood & Harkness LLP, counsel for Plaintiff Cascade Retail Holdings Inc., on February 20, 2025. The scope of my engagement encompasses the following: (a) the forensic imaging and analysis of CRH-issued electronic devices returned by the eight departing employees identified in this litigation (collectively referred to herein as the "Rathore Group"); (b) the analysis of cloud access logs and d

II. SCOPE OF FORENSIC EXAMINATION

5. On February 21, 2025, Pinnacle received and took custody of CRH-issued electronic devices that had been returned by each of the eight departing employees upon or shortly after their simultaneous resignations on February 7, 2025. These devices had been collected by CRH's Information Technology Department on or about February 10, 2025, and stored in a secure, access-controlled location at CRH's corporate headquarter

6. In addition to the physical devices, Pinnacle's examination encompassed the following CRH enterprise systems and cloud environments: (a) CRH's Sundial Systems Environment: CRH utilizes Sundial Systems as its enterprise document management system. The merchandising division, of which all eight members of the Rathore Group were part, maintained extensive document libraries on containing strategic planning documents,

7. Pinnacle conducted the forensic examination using industry-standard forensic imaging protocols and analysis methodologies, consistent with best practices recognized by the digital forensics community and applicable professional standards. The specific methodologies employed in this engagement included the following: (a) Forensic Imaging: Bit-for-bit forensic images of all physical devices were created using Westva

III. SUMMARY OF KEY FINDINGS — DATA EXFILTRATION

8. Based on the forensic analysis described above, Pinnacle identified significant and sustained unauthorized data transfer activity by members of the Rathore Group during the period from January 10, 2025 through February 4, 2025 — a twenty-six (26) day window. During this period, members of the Rathore Group collectively transferred a total of 14,327 files from CRH's enterprise systems (principally Aldermere Systems

9. The timeline of the exfiltration activity identified by Pinnacle is as follows: (a) January 10, 2025 — Onset of Exfiltration Activity: The earliest identified unauthorized data transfer occurred on January 10, 2025. I have been informed by counsel that this date falls four days after a dinner meeting that took place on January 6, 2025, at a restaurant in New York City, between Verdana Commerce Group CEO Warren Die

10. The following table sets forth a breakdown of the exfiltration activity attributable to each individual member of the Rathore Group, based on Pinnacle's forensic analysis: As reflected above, Defendant Priya Rathore was the largest individual contributor, accounting for approximately 29.4% of the total exfiltrated files and approximately 31.3% of the total data volume. A detailed summary table listing the exfiltr

IV. NATURE AND CLASSIFICATION OF EXFILTRATED FILES

11. Pinnacle conducted a content-level review and classification of the 14,327 exfiltrated files. Based on that analysis, the files were classified into the following categories: (a) Project Ridgeline Materials (approximately 3,847 files): This category comprises presentations, strategic planning documents, financial projections, market analyses, and supporting analytical workbooks relating to CRH's five-year categor

12. A significant number of the exfiltrated files bore CRH confidentiality markings embedded in the documents themselves. Specifically, Pinnacle's content analysis identified the following markings appearing on exfiltrated files: (a) "CRH CONFIDENTIAL" — appearing on approximately 8,941 of the 14,327 exfiltrated files (approximately 62.4%); (b) "CRH — INTERNAL USE ONLY" — appearing on approximately 3,287 of the exfil

13. The categories of exfiltrated data described above correspond directly to what I understand to be CRH's core competitive advantages in the omnichannel retail space, particularly in home goods, seasonal décor, and private-label apparel. I have been informed by counsel that Verdana Commerce Group, Inc. ("Verdana") has publicly announced expansion plans in these same product categories and that Verdana directly comp

14. Aldermere Systems Downloads to Personal Cloud Storage. Cloud access logs from CRH's Aldermere Systems environment, corroborated by browser history artifacts and cloud sync client logs recovered from the CRH-issued laptops, reveal the following pattern of activity. Members of the Rathore Group accessed Aldermere Systems document libraries using their CRH credentials through web browser sessions (primarily Ashford

15. Pinnacle Health IT Data Exports. Pinnacle Health IT event monitoring logs provided by CRH reveal that certain members of the Rathore Group — specifically, Defendants Fernandez-Gill, Linden, and Osei — executed bulk data exports from CRH's Pinnacle Health IT instance during the January 10 – February 4, 2025 period. These exports were accomplished through Pinnacle Health IT's native data export and report export fu

16. USB and External Media Activity. Forensic imaging and analysis of the eight CRH-issued laptops revealed USB connection logs — specifically, Windows Registry entries under HKEY\LOCAL\MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR and corresponding Windows Event Log entries (Event IDs 2003 and 2100) — indicating that personal USB storage devices were connected to CRH-issued laptops by multiple members of the Rathore

17. Deletion and Concealment Activity. Forensic analysis identified substantial evidence of deliberate deletion and concealment activity on multiple CRH-issued devices prior to their return on or about February 7, 2025. Specifically, Pinnacle identified the following: (a) Browser History Deletion: On the laptops assigned to Defendants Rathore, Linden, Kaczmarek, and Halvorsen, browser history data (including download

VI. ANALYSIS OF CLOUD ACCESS LOGS POST-RESIGNATION

18. CRH's IT Department disabled enterprise credentials (Aldermere Services Inc. accounts) for all eight members of the Rathore Group upon notification of their resignations. I have been informed that the resignations were submitted on Friday, February 7, 2025, and that credential deactivation was completed on Monday, February 10, 2025 — the first business day following the resignations. During the intervening period

VII. CHAIN OF CUSTODY AND INTEGRITY OF EVIDENCE

19. The chain of custody and evidence integrity procedures employed by Pinnacle in this engagement were as follows. All CRH-issued devices were collected by CRH's IT Department on or about February 10, 2025, and placed in tamper-evident evidence bags with unique identification numbers. The devices were stored in a locked, access-controlled server room at CRH's corporate headquarters located at 2200 Elliott Avenue Wes

20. With respect to CRH's enterprise log data, CRH's IT Department, acting upon instruction from Calderwood & Harkness LLP pursuant to the litigation hold notice issued on February 19, 2025, preserved all relevant enterprise audit logs. The preserved logs include: Aldermere Systems audit logs for the period October 1, 2024 through February 10, 2025; Pinnacle Health IT event monitoring logs for the same period; Alderm

VIII. OPINIONS AND CONCLUSIONS

21. Based on the totality of the forensic evidence described in this declaration, including the analysis of 16 CRH-issued devices, enterprise audit logs from four distinct CRH systems, and the patterns of data transfer, deletion, and post-resignation access activity identified through that analysis, it is my professional opinion, to a reasonable degree of scientific certainty, that the data exfiltration undertaken by

22. The forensic evidence establishes that the exfiltrated data has been transferred to personal cloud storage accounts and potentially to personal USB storage devices that remain entirely outside of CRH's control. At the time of this declaration, there is no evidence that the exfiltrated data has been returned to CRH or destroyed by any member of the Rathore Group. To the contrary, the post-resignation access attemp

23. Based on the findings of this forensic examination, I respectfully recommend that a comprehensive forensic audit be conducted of the following: (a) The personal devices (including personal laptops, desktop computers, tablets, and mobile phones) of each member of the Rathore Group; (b) The personal cloud storage accounts (including Hollowell Health IT, Larkspur Technologies, personal Cobalt Ridge Systems, and any

IX. DOCUMENTS AND MATERIALS REVIEWED

24. In forming the opinions and conclusions set forth in this declaration, I reviewed the following documents and materials: (a) Forensic images of eight (8) CRH-issued laptop computers (Kestrel Solutions series) assigned to the members of the Rathore Group; (b) Forensic images of eight (8) CRH-issued mobile phones (Brightwater Systems) assigned to the members of the Rathore Group; (c) CRH Aldermere Systems audit log

25. The following exhibits are attached to and incorporated by reference in this declaration: Exhibit 1: Curriculum Vitae of Dr. Rajiv Anand, setting forth educational background, professional certifications, employment history, publications, and expert testimony history. Exhibit 2: Summary Table of Exfiltrated Files by Employee, Date, Source System, and File Category — a tabular compilation documenting the 14,327 ex