1008-00005 · Lumos Analytics Inc · Strategy & Analysis

memo-crestview-forensic-findings.docx DOCUMENT Litigation

35 / 35 ← ✕

Contract analysis Extract to table

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP Attorneys at Law

Matter No.: 1008-00005 Case No.: 23-CV-004871 (Superior Court of the State of California, County of Santa Clara)

Date: May 5, 2023

INTERNAL MEMORANDUM

TO: Wendy Schultz, Lead Associate; Marcus Delgado, Responsible Partner; Catherine Bloom, Billing Partner

FROM: Omar Siddiqui, Working Associate

RE: Summary of Key Findings from Brindoval Digital Forensics LLC Preliminary Forensic Report (Issued May 1, 2023)

CONFIDENTIALITY NOTICE: This memorandum constitutes attorney work product prepared in anticipation of litigation and is protected by the work-product doctrine and the attorney-client privilege. It contains the mental impressions, conclusions, opinions, and legal theories of attorneys at Calderwood & Harkness LLP in connection with their representation of Lumos Analytics Inc. in the above-captioned matter. This memorandum is intended solely for the use of the addressees identified above and other members of the Calderwood & Harkness LLP litigation team assigned to this matter. Do not distribute outside the litigation team without prior authorization from the Responsible Partner. Any unauthorized disclosure may constitute a waiver of applicable privileges and protections.

I. Executive Summary

Brindoval Digital Forensics LLC ("Brindoval"), the neutral forensic examiner appointed by stipulation of the parties on March 8, 2023 and approved by the Honorable David Rutherford, Superior Court of the State of California, County of Santa Clara, issued its Preliminary Forensic Report on May 1, 2023 (the "Report"). The purpose of this memorandum is to provide the litigation team with a comprehensive summary of the Report's key findings, to flag the most significant evidentiary implications for our client's claims, and to set forth recommended next steps for case strategy.

At the outset, the headline conclusion is favorable and significant: the Report confirms the presence of Lumos Analytics Inc. ("Lumos") proprietary materials across NovaSpark Technologies Inc. ("NovaSpark") corporate servers and the personal devices and cloud storage accounts of all three individual defendants—Rajiv Anand, Serena Mallick, and Derek Yun. This is precisely the result we anticipated based on our client's internal audit findings, but the independent forensic confirmation by a court-approved neutral examiner carries substantial evidentiary weight that will be difficult for Defendants to challenge or dismiss.

The forensic examination was conducted between March 22, 2023 and April 14, 2023 by Dr. Irene Chow, Managing Director and Lead Forensic Examiner at Brindoval, and Kevin Barr, Senior Forensic Analyst at Brindoval. Both examiners have extensive credentials in digital forensics and are expected to be available to provide testimony regarding their findings if required. The examination encompassed corporate servers, personal laptops, personal smartphones, external storage devices, and cloud storage accounts associated with each of the individual defendants and with NovaSpark.

This memorandum was prepared in consultation with Naveen Kapoor, Senior Consultant at Meridian Cybersecurity Advisors Inc. ("Meridian"), Lumos's retained technical and cybersecurity consultant. Meridian was engaged by Calderwood & Harkness on behalf of Lumos pursuant to the engagement letter dated February 22, 2023. Kapoor independently reviewed the Report and the underlying forensic images and provided supplemental technical analysis, including a detailed code-comparison report, which is attached to this memorandum as Appendix B. Kapoor's independent review and analysis corroborate and, in certain respects, augment Brindoval's findings.

The forensic evidence substantially corroborates Lumos's allegations of misappropriation across all five categories of trade secrets identified in the Verified Complaint and at issue in this litigation:

1. LumosEdge Ensemble ML Model Architecture — including neural-network topology definitions, hyperparameter configuration files, and signal-generation engine specifications;

2. Proprietary Feature-Engineering Libraries — encompassing 2,847 individually engineered features used for financial signal generation, documented in Jupyter notebook format;

3. DataStream ETL Pipeline Codebase and Data-Schema Definitions — the proprietary extract, transform, and load pipeline covering ingestion protocols and data-schema definitions for all 43 alternative-data vendors integrated into the Lumos platform;

4. Curated Training Dataset — the approximately 14.6 terabyte training dataset developed by Lumos over a period of more than four years at a cost exceeding $7.3 million (as alleged in the Verified Complaint); and

5. Confidential LumosEdge 3.0 Product Roadmap Documents — a 37-page internal strategy document detailing unreleased product specifications, planned features, and development milestones for the period 2023 through 2025.

As discussed in greater detail below, the forensic evidence not only confirms that Lumos's proprietary materials were taken by the individual defendants prior to their departures from Lumos, but also demonstrates that those materials were subsequently transferred to and integrated into NovaSpark's corporate development environment and actively used in NovaSpark's product development efforts. Moreover, communications recovered from the personal smartphones of Anand and Mallick reveal a coordinated scheme among all three defendants, planned as early as August 2022—well before NovaSpark's incorporation—to systematically exfiltrate the proprietary materials most relevant to each defendant's area of expertise.

The evidentiary implications are addressed in Section IX below, along with recommendations for incorporating the forensic findings into our deposition strategy and broader litigation approach.

II. Scope of Forensic Examination

A. Devices and Systems Imaged

Pursuant to the terms of the March 8, 2023 Stipulation and Order Regarding Forensic Examination (the "Stipulation"), Brindoval was authorized to image and examine the following devices, systems, and accounts. The Report confirms that all of the following were successfully imaged and examined during the examination period:

1. NovaSpark Corporate Servers. Brindoval imaged the NovaSpark corporate server environment located at NovaSpark's offices at 88 Bluxome Street, Floor 4, San Francisco, California 94107. The corporate server environment included NovaSpark's primary development server, a staging server, and associated network-attached storage. The total volume of data imaged from the corporate servers was approximately 4.7 terabytes.

2. Personal Laptops. Brindoval imaged three personal laptops belonging to each of the individual defendants:

(a) Rajiv Anand — Tidewater Industries MacBook Pro, 16-inch, 2021 model (Serial No. C02GR3XXXXX);

(b) Serena Mallick — Brightmoor Group XPS 15, 2020 model (Service Tag: HGRT7XXXXX); and

3. Personal Smartphones. Brindoval imaged two personal smartphones:

(a) Rajiv Anand — Ashbury Corporation 14 Pro (IMEI: 35491XXXXXXXXX); and

(b) Serena Mallick — Northgate & Co. Galaxy S22 (IMEI: 35287XXXXXXXXX).

The Report notes that Derek Yun represented, through counsel, that he did not use a personal smartphone for work-related communications during the relevant period and that his only smartphone was replaced and recycled through a carrier trade-in program in December 2022. Defendants' counsel has represented that no forensic image of Yun's prior device is available. We should note this as a potential spoliation issue for future motion practice if warranted.

4. External Storage Drives. Brindoval imaged two external storage drives:

(a) Glenrock Industries external USB hard drive, serial number WD-4837291, identified as belonging to Serena Mallick; and

(b) Beaumont Solutions portable SSD, serial number S5NENS0XXXXX, identified as belonging to Rajiv Anand. The Report notes this drive was largely empty at the time of imaging, with evidence of recent formatting, but residual data fragments were recovered through carving analysis.

5. Cloud Storage Accounts. Brindoval obtained and examined data from the following cloud storage accounts:

(a) Rajiv Anand's personal Hollowell Health IT account (email address: r.anand.personal@vaultmail.com);

(b) Derek Yun's personal Larkspur Technologies account (email address: d.yun.private@Greaves Systems.com); and

(c) NovaSpark's corporate cloud repositories, including a Tidewater Solutions organization account and an Ridgeway Industries (Meridian Technologies) S3 storage bucket associated with NovaSpark's development environment.

B. Methodology

The Report describes the forensic examination methodology employed by Brindoval in detail at Section 3 of the Report. For the purposes of this memorandum, the key methodological elements are summarized as follows:

1. Forensic Imaging. All devices and storage media were imaged using industry-standard bit-for-bit imaging protocols, specifically using the Calderon Technologies and Stonefield Software imaging tools. Each forensic image was verified against the original media using SHA-256 hash verification to ensure data integrity. Chain of custody was maintained throughout the imaging and examination process in accordance with the procedures specified in the Stipulation. Brindoval's chain-of-custody documentation is included as Exhibit 2 to the Report.

2. File-Matching Analysis. The core of Brindoval's analysis involved SHA-256 hash-value comparison of files found on Defendants' devices and systems against Lumos-provided reference copies of its proprietary materials. Lumos provided Brindoval with a reference set of proprietary files on March 20, 2023, two days prior to the commencement of the examination, in accordance with the timeline set forth in the Stipulation. The reference set was delivered on encrypted media and included the complete LumosEdge source code repository, the DataStream ETL pipeline repository, the feature-engineering library (Jupyter notebooks), sample subsets of the training dataset, and the LumosEdge 3.0 Product Roadmap document. Hash-value matching provides a mathematically certain confirmation that two files are identical at the byte level; the probability of a false positive (i.e., two different files producing the same SHA-256 hash) is astronomically low (approximately 1 in 2^256).

3. Timestamp and Metadata Analysis. Brindoval conducted detailed analysis of file creation dates, modification dates, and last-access dates for all files of interest. Metadata embedded within the files—including authorship information, internal directory paths, project tags, and version-control metadata—was also analyzed. This analysis was critical to establishing the timeline of exfiltration events and the subsequent movement of files from personal devices and accounts to NovaSpark's corporate systems.

4. Transfer and Connection Log Analysis. Brindoval analyzed file-transfer logs, browser download histories, USB device-connection logs (from both Lumos-issued and personal devices), and cloud synchronization records to reconstruct the methods and timing of data transfers. This analysis included examination of Windows Event Logs, macOS Unified Logs, and application-specific logs for Hollowell Health IT, Larkspur Technologies, and other cloud services.

5. Email and Messaging Artifact Recovery. Brindoval recovered email artifacts from personal devices, including locally cached email messages, and messaging application records from personal smartphones. The messaging artifacts included text messages (SMS and Westmark Software) and records from the signal encrypted messaging application. The Report notes that while signal message content was recoverable in certain instances due to local device storage, the recovery was partial and some message threads may be incomplete.

C. Parties' Agreed Framework

Brindoval was appointed pursuant to the March 8, 2023 Stipulation and Order Regarding Forensic Examination, which was negotiated between the parties and submitted to the Court for approval. The Stipulation was signed by Marcus Delgado on behalf of Lumos and by Patricia Whitfield of Whitfield, Raines & Gerber LLP on behalf of Defendants. The Honorable David Rutherford signed the corresponding Order on March 10, 2023, formally appointing Brindoval and establishing the framework for the examination.

The total fees for the Brindoval forensic examination, as set forth in the Report, are $218,600. Pursuant to the cost-allocation provisions of the Stipulation, these fees are allocated sixty percent (60%) to Defendants and NovaSpark, in the amount of $131,160, and forty percent (40%) to Lumos, in the amount of $87,440. The cost-allocation provision was a negotiated compromise; Defendants initially sought a 50/50 split, while Lumos argued that Defendants should bear 100% of the costs given that the examination was necessitated by Defendants' alleged misconduct. The 60/40 allocation reflects the Court's suggestion during the March 6, 2023 case management conference.

Both parties' counsel received the Report simultaneously on May 1, 2023, in accordance with the Stipulation's provisions regarding simultaneous disclosure. The Report was transmitted via Brindoval's secure document portal, and confirmation of receipt was acknowledged by both Calderwood & Harkness and Whitfield, Raines & Gerber on the same date.

III. Key Findings — Rajiv Anand

Rajiv Anand served as Vice President of Machine Learning at Lumos from June 2019 through his resignation on October 14, 2022. In his role, Anand had broad access to the LumosEdge model architecture, training datasets, and product strategy materials. He subsequently joined NovaSpark as its Co-Founder and Chief Technology Officer. The forensic evidence pertaining to Anand is among the most significant in the Report and is summarized below.

A. Hollowell Health IT Exfiltration (September 26, 2022)

Brindoval confirmed that on September 26, 2022—approximately eighteen days before Anand's resignation from Lumos—approximately 3.2 gigabytes of files were transferred from Anand's Lumos-issued workstation (a Brightmoor Group Precision 5560 mobile workstation, asset tag LUM-WS-4471) to a personal Hollowell Health IT account. The Hollowell Health IT account was authenticated under Anand's personal credentials, associated with the email address r.anand.personal@vaultmail.com. The transfer was accomplished via the Hollowell Health IT desktop synchronization client, which Anand had installed on his Lumos-issued workstation. Brindoval's analysis of the Hollowell Health IT sync logs, recovered from the Lumos workstation's local application data directory, confirmed the timing and volume of the transfer.

File-matching analysis yielded significant results. SHA-256 hash values of eighty-seven (87) individual files found in the Hollowell Health IT account matched corresponding files in the Lumos proprietary codebase reference set provided to Brindoval. The matched files were not trivial or generic in nature; rather, they constitute core components of the LumosEdge system.

Specifically, the content of the transferred files includes:

• LumosEdge ensemble machine-learning model architecture specifications, including the full model definition files for the proprietary ensemble of gradient-boosted decision trees and deep neural networks that form the backbone of Lumos's signal-generation engine;

• Neural-network topology configuration files, specifying layer structures, activation functions, attention mechanisms, and interconnection architectures for the deep-learning components of the LumosEdge system;

• Hyperparameter configuration files, containing the precise tuning parameters (learning rates, regularization coefficients, batch sizes, dropout rates, ensemble weighting schemes, and related parameters) that Lumos developed through extensive experimentation and computational investment over a period of more than two years; and

• Supporting documentation files, including internal design memoranda and technical notes authored by members of the Lumos ML engineering team under Anand's supervision.

These files collectively constitute the core of the LumosEdge signal-generation engine and represent what Lumos has identified in its trade-secret disclosure as among its most valuable and competitively sensitive proprietary assets.

Metadata analysis further strengthens the evidentiary picture. The files found in Anand's Hollowell Health IT account retain their original Lumos internal directory path structures (e.g., /lumos/lumosedge/models/ensemble/v2.7/, /lumos/lumosedge/config/hyperparams/) and authorship metadata, including Lumos employee IDs and internal project tags (e.g., "PROJ-EDGE-2022," "TEAM-ML-CORE"). The preservation of this metadata is significant because it eliminates any argument that the files were independently created or derived from publicly available sources; the files bear unambiguous markers of their Lumos origin.

B. LumosEdge 3.0 Product Roadmap (September 28, 2022)

Two days after the Hollowell Health IT transfer, on September 28, 2022, Anand took a separate action to exfiltrate Lumos's confidential strategic planning materials. Brindoval confirmed that on that date, Anand forwarded the confidential "LumosEdge 3.0 Product Roadmap" from his Lumos corporate email account (r.anand@lumos-analytics.com) to his personal email address, r.anand.personal@vaultmail.com. The email was sent at approximately 11:42 PM Pacific Time, outside of normal business hours.

The LumosEdge 3.0 Product Roadmap is a 37-page PDF document, bearing the header "CONFIDENTIAL — LUMOS ANALYTICS INC. — DO NOT DISTRIBUTE" on each page. It was prepared by Lumos's product strategy team in August 2022 and distributed internally on a need-to-know basis. The roadmap contains unreleased product specifications for LumosEdge 3.0, the next major version of Lumos's flagship product, covering planned features, architectural enhancements, new data-source integrations, target client segments, development milestones, and projected timelines for the period 2023 through 2025. As alleged in the Verified Complaint, this document represents a comprehensive blueprint for Lumos's future competitive direction.

Brindoval recovered a copy of the PDF from Anand's personal laptop during the forensic imaging process. Additionally, and of particular significance, the same document was located on NovaSpark's corporate servers in a directory labeled "/strategy/competitive-intel/". The directory name itself is notable, as it suggests that NovaSpark categorized and stored the Lumos roadmap as "competitive intelligence"—acknowledging its competitive significance while simultaneously evidencing deliberate use of a competitor's confidential materials.

SHA-256 hash-value comparison confirmed that the copy of the document found on NovaSpark's corporate servers is byte-for-byte identical to the Lumos original provided in the reference set. There are no modifications, redactions, or alterations of any kind. NovaSpark possesses an exact duplicate of Lumos's most sensitive forward-looking strategic document.

C. Presence on NovaSpark Systems

Beyond the roadmap document, Brindoval's examination of NovaSpark's corporate servers revealed that portions of the LumosEdge model architecture files—the same files transferred to Anand's Hollowell Health IT on September 26, 2022—were found integrated into NovaSpark's active development environment. These files were not simply stored in a passive archive; they were located within NovaSpark's working source-code repositories and showed evidence of being incorporated into NovaSpark's own product codebase.

Timestamp analysis indicates that these files were first copied to NovaSpark's systems on or around October 8, 2022. This date is significant for several reasons: it is only five days after NovaSpark's October 3, 2022 incorporation in the State of Delaware, suggesting that the transfer of Lumos's proprietary technology was among the very first substantive activities undertaken by the newly formed company. It is also six days before Anand's formal resignation from Lumos on October 14, 2022, raising the additional issue of whether Anand was actively building NovaSpark's technology platform using Lumos's trade secrets while still employed by Lumos—a fact directly relevant to the breach-of-duty-of-loyalty claim.

Brindoval's analysis of Anand's Hollowell Health IT sync logs corroborates the transfer pathway. The logs show that the files in question were accessed from a device matching the MAC address of a NovaSpark-issued laptop assigned to Anand (MAC address: A4:83:E7:XX:XX:XX), indicating that Anand used his NovaSpark device to download the files from his personal Hollowell Health IT and subsequently uploaded or copied them to NovaSpark's corporate development servers. This establishes a clear chain of custody for the misappropriated materials: Lumos workstation → personal Hollowell Health IT → NovaSpark laptop → NovaSpark corporate servers.

IV. Key Findings — Serena Mallick

Serena Mallick served as a Senior Data Engineer at Lumos from March 2020 through her resignation on October 14, 2022 (the same date as Anand's resignation—a coincidence that the coordination evidence discussed in Section VI below reveals was not coincidental at all). In her role, Mallick was the primary architect and lead developer of the DataStream ETL pipeline, Lumos's proprietary system for ingesting, transforming, and loading alternative data from third-party vendors. She subsequently joined NovaSpark as Vice President of Engineering on October 17, 2022, only three days after her departure from Lumos. The forensic evidence pertaining to Mallick centers on the exfiltration of the DataStream ETL pipeline codebase.

A. USB Drive Exfiltration (October 10, 2022)

Brindoval imaged the external USB hard drive bearing serial number WD-4837291, a Glenrock Industries Elements portable drive with a storage capacity of 2 terabytes. The drive was confirmed as belonging to Mallick based on purchase records subpoenaed from Glenrock Industries and corroborated by Mallick's own identification of the drive during the imaging session conducted pursuant to the Stipulation.

The forensic image of USB drive WD-4837291 revealed that the drive contained a complete clone of the DataStream ETL pipeline repository, totaling approximately 780 megabytes of source code, configuration files, data-schema definitions, documentation, and associated build scripts. SHA-256 hash-value comparison of the repository files against the Lumos reference copy confirmed a match across all 1,247 individual source files contained in the repository. The match rate was 100%—every single file on the USB drive corresponding to the DataStream repository was identical to its Lumos counterpart. This is not a case of partial or fragmentary copying; Mallick took a complete, fully functional copy of the entire DataStream system.

The DataStream ETL pipeline codebase is a proprietary and highly valuable component of Lumos's technology platform. It includes:

• The core extract, transform, and load processing engine, written primarily in Python and Scala;

• Proprietary data-schema definitions covering the ingestion protocols, data-normalization rules, and transformation logic for all 43 alternative-data vendors integrated into Lumos's platform, including providers of satellite imagery data, web-scraping data, credit-card transaction data, geolocation data, and other non-traditional data sources used in quantitative financial analysis;

• Vendor-specific API integration modules, each customized to the unique data formats, authentication protocols, delivery mechanisms, and rate-limiting constraints of the respective vendors;

• Data-quality validation and anomaly-detection routines developed over more than two years of iterative refinement; and

• Comprehensive internal documentation, including architecture diagrams, data-flow specifications, and developer guides.

Critically, Brindoval's analysis of USB device-connection logs recovered from Mallick's Lumos-issued workstation (a Lenovo ThinkPad X1 Carbon, asset tag LUM-WS-5923) confirms the precise timing of the exfiltration. The logs show that USB drive WD-4837291 was connected to the Lumos workstation on October 10, 2022 at 9:47 PM Pacific Time. A bulk file-copy operation was initiated at 9:52 PM and completed at 10:14 PM—a window of approximately twenty-two minutes during which the entire 780 MB repository was copied to the external drive. The late hour of this activity (nearly 10:00 PM on a weekday evening) is consistent with a deliberate effort to conduct the exfiltration outside of normal business hours and away from the observation of colleagues. October 10, 2022 was four days before Mallick's October 14 resignation from Lumos.

B. Presence on NovaSpark Systems

Brindoval identified the DataStream ETL pipeline codebase on NovaSpark's corporate development servers, located in a directory labeled "/core-pipelines/data-ingest/". The presence of the complete DataStream system on NovaSpark's servers is direct evidence that the misappropriated materials were not merely taken but were actively deployed in NovaSpark's product development.

File metadata analysis indicates that these files were first uploaded to NovaSpark's systems on October 19, 2022—only two days after Mallick commenced her employment at NovaSpark as Vice President of Engineering on October 17, 2022. The rapidity with which the Lumos materials appeared on NovaSpark's servers after Mallick's first day of employment at NovaSpark further corroborates the pre-planned nature of the misappropriation.

Brindoval and Meridian's analyses both confirm that portions of the DataStream code found on NovaSpark's servers had been modified relative to the Lumos originals. However, Naveen Kapoor's independent code-comparison analysis (Appendix B) conclusively demonstrates that these modifications were cosmetic in nature. Specifically, the modifications consisted of:

• Renaming of variables and function names (e.g., changing "lumosetlprocessor" to "novadatapipeline," renaming internal module references from "datastream" to "novastream");

• Stripping of comments and internal documentation headers that contained Lumos-specific references, copyright notices, and attribution information;

• Minor reformatting of code (e.g., changes to indentation style, line-break conventions); and

• Replacement of Lumos-branded configuration labels with NovaSpark-branded equivalents.

Despite these surface-level changes, the underlying algorithmic logic, data-schema structures, pipeline architecture, processing sequences, error-handling routines, and vendor-specific integration protocols remain substantively identical to Lumos's proprietary DataStream system. Kapoor's report characterizes the modifications as a deliberate but superficial attempt to disguise the provenance of the code—what is colloquially referred to in the software industry as "code laundering." The substantive identity of the two codebases is unmistakable to any qualified examiner.

V. Key Findings — Derek Yun

Derek Yun served as a Machine Learning Engineer at Lumos from January 2021 through his resignation on October 21, 2022. In his role, Yun was responsible for developing and maintaining Lumos's proprietary feature-engineering libraries—the extensive collection of engineered features used to transform raw alternative data into predictive signals for the LumosEdge platform. He subsequently joined NovaSpark as a Founding Engineer on October 24, 2022, only three days after his departure from Lumos. The forensic evidence pertaining to Yun centers on the exfiltration of the feature-engineering libraries.

A. Larkspur Technologies Exfiltration (October 18, 2022)

Brindoval confirmed that on October 18, 2022, forty-seven (47) proprietary Jupyter notebooks were downloaded from Lumos's internal code repository (a self-hosted Aldermere Software instance) and synced to Yun's personal Larkspur Technologies account, associated with the email address d.yun.private@Greaves Systems.com. The download was conducted from Yun's Lumos-issued workstation (an Tidewater Industries MacBook Pro, 16-inch, 2021 model, asset tag LUM-WS-6187), and the files were transferred to Yun's personal Larkspur Technologies via the Larkspur Technologies desktop synchronization client installed on the workstation.

These 47 Jupyter notebooks contain feature-engineering code and model-training scripts that together encompass significant portions of Lumos's proprietary library of 2,847 engineered features for financial signal generation. Each notebook represents a substantial body of proprietary work, containing not only executable code but also extensive inline documentation explaining the rationale, data-science methodology, and empirical validation results for the features defined therein. The feature-engineering library is the product of years of research and experimentation by Lumos's data science team and represents one of the company's most competitively significant assets—the engineered features are, in essence, the "secret sauce" that allows LumosEdge to generate predictive financial signals from raw alternative data.

SHA-256 hash-value matching confirmed that all 47 of 47 notebooks found in Yun's Larkspur Technologies account are identical to the corresponding Lumos originals in the reference set. The match is complete and unambiguous—there is no question that the files in Yun's Larkspur Technologies are exact copies of Lumos proprietary materials.

Larkspur Technologies sync metadata records the upload timestamp as October 18, 2022 at 6:23 PM Pacific Time. This date is notable because it falls three days before Yun's October 21, 2022 resignation from Lumos. As with the Anand and Mallick exfiltrations, the timing is consistent with a deliberate pre-departure plan to extract proprietary materials before giving notice.

B. Presence on NovaSpark Systems

Brindoval's examination of NovaSpark's corporate development servers revealed that 39 of the 47 exfiltrated Jupyter notebooks were present on NovaSpark's servers, located in a directory labeled "/ml-models/feature-lib/". The fact that 39 of 47 notebooks (approximately 83%) were transferred to NovaSpark's systems indicates extensive, though not complete, incorporation of the Lumos feature-engineering library into NovaSpark's development environment. The eight notebooks not found on NovaSpark's servers may have been excluded because they pertained to data sources or feature categories that NovaSpark chose not to replicate, or they may have been stored elsewhere on NovaSpark's systems in a location not captured by Brindoval's examination—a possibility that warrants further investigation.

Timestamp analysis indicates that these 39 files were first uploaded to NovaSpark's systems on October 26, 2022—two days after Yun commenced employment at NovaSpark as a founding engineer on October 24, 2022. This pattern is remarkably consistent across all three defendants: in each case, Lumos proprietary materials appeared on NovaSpark's corporate systems within days of the respective defendant's start date at NovaSpark, strongly suggesting that the transfer of misappropriated materials was a primary objective of each defendant's initial activities at the company.

Of particular significance, several of the Jupyter notebooks found on NovaSpark's servers showed evidence of active use and modification within NovaSpark's development environment. Specifically, Brindoval identified execution logs associated with the notebooks dating from November 2022 through January 2023, indicating that the Lumos feature-engineering code was not merely stored passively but was actively run, tested, and iterated upon by NovaSpark personnel during this period. This evidence of active use is directly relevant to our damages theory, as it demonstrates that NovaSpark derived tangible benefit from the misappropriated materials in furtherance of its own product development.

VI. Cross-Referencing and Coordination Evidence

Perhaps the most damaging category of evidence identified in the Report—from the perspective of Defendants' potential defenses—is the coordination evidence recovered from the personal smartphones of Rajiv Anand and Serena Mallick. This evidence transforms the narrative from one of three potentially independent acts of misappropriation into a single, coordinated scheme orchestrated in advance by all three defendants acting in concert.

Brindoval identified communications—consisting of text messages (SMS and Westmark Software) and messaging-application records (Harborline Technologies)—recovered from Anand's Ashbury Corporation 14 Pro and Mallick's Northgate & Co. Galaxy S22 that demonstrate explicit coordination among all three defendants regarding the timing of their departures from Lumos and the specific types of proprietary materials to be taken by each individual.

The recovered messages show that the coordination began as early as August 2022, approximately two months before any of the defendants resigned from Lumos. Messages from this period discuss the founding of a competing venture, reference specific Lumos technologies by their internal project code names (including "EDGE" for the LumosEdge platform, "DSTREAM" for the DataStream ETL pipeline, and "FEATLIB" for the feature-engineering library), and outline the respective roles each defendant would play in the new venture.

One message is particularly significant. On September 15, 2022, Anand sent a message to Mallick and Yun in a group message thread. The message states, in substance, that each individual should "secure" the materials most relevant to their respective areas of expertise before departing from Lumos. While the exact language of the message is set forth in the Report and should be reviewed in its entirety by the litigation team, the substance of the instruction is clear: Anand directed each defendant to systematically exfiltrate the Lumos proprietary materials within their respective domains of responsibility—the model architecture for Anand, the ETL pipeline for Mallick, and the feature-engineering library for Yun.

The timeline of the coordination evidence is also significant in the broader context of NovaSpark's formation and funding. The messages predate NovaSpark's October 3, 2022 incorporation in the State of Delaware, indicating that the plan to misappropriate Lumos's trade secrets was conceived before NovaSpark even existed as a legal entity. The messages also predate the November 15, 2022 close of NovaSpark's $12 million seed funding round from Blackpine Capital Partners LP, a venture capital fund managed by Franklin Osei. This raises the additional question—which may warrant further discovery—of whether NovaSpark's pitch materials to Blackpine referenced or relied upon Lumos technology, and whether Blackpine was aware of the provenance of NovaSpark's technology when it committed to the investment.

The coordination evidence substantially undermines any potential defense of inadvertent or incidental possession. Defendants cannot credibly argue that the presence of Lumos materials on their personal devices or on NovaSpark's servers was the result of accident, mistake, or routine backup practices. The September 15 message alone—directing each defendant to "secure" specific categories of materials—constitutes powerful evidence of willful and malicious misappropriation, a finding that would support an award of exemplary damages under California Civil Code § 3426.3(c).

VII. Summary of Proprietary Material Categories Found on Defendants' Systems

The following table summarizes, by trade-secret category, where Lumos proprietary materials were identified by Brindoval during the forensic examination:

Several observations merit emphasis based on this summary:

First, the division of exfiltrated materials maps precisely to each defendant's area of expertise and responsibility at Lumos: Anand took the ML model architecture (his domain as VP of Machine Learning); Mallick took the DataStream ETL pipeline (her domain as the primary architect of that system); and Yun took the feature-engineering libraries (his domain as a Machine Learning Engineer focused on feature development). This pattern is entirely consistent with the coordinated scheme revealed by the messaging evidence discussed in Section VI.

Second, all five categories of trade secrets at issue in this litigation are represented across the Defendants' collective systems, with materials from four of the five categories confirmed present on NovaSpark's corporate servers. The only category not found in its entirety is the training dataset (Category 4), which is unsurprising given its massive size (14.6 TB); however, partial subsets and references were found, indicating that Defendants accessed or utilized portions of the dataset.

Third, the presence of materials on NovaSpark's corporate servers—as distinguished from merely on the individual defendants' personal devices—is critically important. It establishes NovaSpark's direct involvement in the misappropriation and supports our claims against the corporate entity, not only against the individual defendants.

VIII. Meridian Cybersecurity Advisors — Independent Assessment

Naveen Kapoor, Senior Consultant at Meridian Cybersecurity Advisors Inc. (located at 2100 Geng Road, Suite 210, Palo Alto, California 94303), independently reviewed the Brindoval Report and the underlying forensic images pursuant to Meridian's engagement by Calderwood & Harkness on behalf of Lumos. Kapoor holds a Master of Science in Computer Science from Stanford University and has over fifteen years of experience in digital forensics, cybersecurity, and intellectual property litigation support. His qualifications are detailed in Meridian's engagement letter and curriculum vitae on file with the firm.

Kapoor's independent assessment, delivered to Calderwood & Harkness on May 3, 2023 (Appendix B), provides the following key conclusions:

1. Validation of Methodology. Kapoor confirms that Brindoval's file-matching methodology is sound and consistent with industry best practices for digital forensic examination. The use of SHA-256 hash-value comparison is the accepted standard for file-identity verification in forensic contexts, and Brindoval's implementation of that methodology, as described in the Report, is technically rigorous.

2. Reliability of Hash-Value Comparisons. Kapoor confirms that the hash-value comparisons reported by Brindoval are reliable and that the matched files are, with mathematical certainty, identical to the Lumos originals. There is no reasonable basis to challenge the accuracy of the file-matching results.

3. Consistency of Timestamp Evidence. Kapoor confirms that the timestamp evidence presented in the Report is internally consistent. The file creation dates, modification dates, sync timestamps, and device-connection logs all corroborate one another and are consistent with the exfiltration timeline described in the Report. Kapoor found no evidence of timestamp manipulation or inconsistencies that would undermine the reliability of the chronological reconstruction.

4. Supplemental Code-Comparison Analysis. Kapoor conducted a detailed supplemental code-comparison analysis on the modified DataStream ETL pipeline files found on NovaSpark's corporate development servers. This analysis employed both automated comparison tools (including structural code-similarity analysis using abstract syntax tree comparison) and manual expert review. Kapoor's conclusions are unequivocal: the modifications made to the DataStream code on NovaSpark's servers were cosmetic in nature, consisting of the renaming of variables and functions, the stripping of comments and internal documentation headers bearing Lumos attribution, and minor formatting changes. The underlying algorithmic logic, data-schema structures, pipeline architecture, processing sequences, error-handling routines, and vendor-specific integration protocols are substantively identical to Lumos's proprietary DataStream system. Kapoor quantifies the structural code similarity at approximately 97.3% based on abstract syntax tree comparison, with the remaining 2.7% attributable to the cosmetic modifications described above.

5. Lumos-Specific Internal Identifiers on NovaSpark Systems. Kapoor's analysis further identified an additional category of evidence not specifically highlighted in the Brindoval Report. Certain NovaSpark development logs—including build logs, test execution records, and developer commit messages within NovaSpark's version-control system—reference Lumos-specific internal identifiers. These include:

(a) Internal project code names used exclusively within Lumos (e.g., "DSTREAM-v4.2," "EDGE-ENSEMBLE-RC1");

(b) Vendor API keys belonging to Lumos, which appear to have been inadvertently carried over from the misappropriated DataStream codebase and used during NovaSpark's development and testing activities—a finding that not only evidences the use of Lumos materials but also potentially implicates unauthorized access to third-party data vendor systems using Lumos's credentials; and

(c) References to Lumos internal documentation URLs and confluence wiki page identifiers in developer notes and commit messages.

These residual Lumos-specific identifiers provide additional, independent evidence that NovaSpark's product development incorporated Lumos proprietary materials. They are the digital equivalent of fingerprints left behind despite an attempt to wipe down the scene—traces of origin that the cosmetic code modifications failed to eliminate.

Kapoor's full supplemental analysis is attached as Appendix B and should be reviewed by the litigation team in its entirety. Kapoor has indicated that he is available to expand his analysis into a formal expert report suitable for submission to the Court if the team determines that expert testimony will be required.

IX. Implications for Litigation Strategy

A. Strengthening of Claims

The forensic evidence documented in the Brindoval Report and corroborated by Meridian's independent analysis strongly supports all five causes of action set forth in the Verified Complaint filed on January 18, 2023:

(1) Trade Secret Misappropriation under the California Uniform Trade Secrets Act (Cal. Civ. Code §§ 3426–3426.11). The Report provides direct evidence of both "acquisition" of Lumos trade secrets by improper means (unauthorized copying and exfiltration) and "use" of those trade secrets by NovaSpark (integration into NovaSpark's development environment and active deployment in product development). The coordination evidence, particularly the September 15, 2022 directive to "secure" specific materials, establishes that the acquisition was accomplished through willful and deliberate misconduct, supporting a claim for exemplary damages under Section 3426.3(c) in an amount up to twice the compensatory damages award.

(2) Breach of Contract (Proprietary Information and Inventions Assignment Agreement). Each of the three individual defendants executed a Proprietary Information and Inventions Assignment Agreement ("PIIAA") upon commencing employment at Lumos. Each PIIAA contains restrictive covenant provisions, including a confidentiality and non-disclosure provision that expressly survives termination of employment for a period of three years. The PIIAAs also include a covenant not to use or disclose Lumos trade secrets or confidential information at any time, without temporal limitation. The forensic evidence provides conclusive proof that each defendant breached these contractual obligations by copying, retaining, and transferring Lumos proprietary materials to NovaSpark for use in a competing product.

(3) Breach of Duty of Loyalty. The timestamp evidence is particularly relevant to this claim. The forensic record shows that Anand and Mallick exfiltrated Lumos materials while still employed by Lumos (Anand on September 26 and 28, 2022; Mallick on October 10, 2022; both resigned October 14, 2022). Yun exfiltrated materials on October 18, 2022, three days before his October 21 resignation. Moreover, the coordination evidence shows that all three defendants were planning a competing venture as early as August 2022 while still receiving compensation from Lumos—a clear breach of the common-law duty of loyalty owed by employees to their employer.

(4) Unfair Business Practices under California Business and Professions Code § 17200. NovaSpark's use of misappropriated trade secrets to develop a competing product and secure $12 million in venture funding constitutes an unfair and unlawful business practice within the meaning of Section 17200. The forensic evidence establishes the factual predicate for this claim with particular strength.

(5) Conversion. The physical taking of proprietary materials—including the complete cloning of the DataStream repository to a USB drive and the downloading of Jupyter notebooks—supports the conversion claim. While conversion claims in the trade-secret context can be legally complex, the forensic evidence of specific, identifiable property (files with unique hash values) taken from Lumos's possession strengthens this cause of action.

In addition to the affirmative strength of Lumos's claims, the coordination evidence recovered from Anand's and Mallick's personal smartphones substantially undermines any potential defense of inadvertent or incidental possession. The messaging evidence demonstrates premeditation, deliberate planning, and coordinated execution of the misappropriation scheme, eliminating the possibility that the defendants might credibly claim that Lumos materials ended up on their personal devices or on NovaSpark's servers through accident, routine backup practices, or any other innocent explanation.

B. Upcoming Depositions

The forensic findings from the Report should be deployed strategically at the upcoming depositions of each individual defendant. The current deposition schedule is as follows:

• Rajiv Anand — deposition scheduled for May 15, 2023;

• Serena Mallick — deposition scheduled for June 7, 2023; and

• Derek Yun — deposition scheduled for June 22, 2023.

Each deposition should be structured to confront the respective defendant with the specific files, timestamps, and communications identified in the Report. The forensic evidence provides a powerful tool for locking each defendant into a factual record regarding the exfiltration events, the transfer of materials to NovaSpark, and the coordination among the defendants. Key objectives for each deposition should include:

• Establishing each defendant's knowledge of the confidential and proprietary nature of the materials taken;

• Confirming the authenticity of the recovered communications and obtaining admissions regarding the coordination scheme;

• Exploring each defendant's account of the purpose and circumstances of the file transfers;

• Identifying any additional individuals at NovaSpark (beyond the three defendants) who accessed or used the misappropriated materials; and

• Probing the relationship between NovaSpark's product development efforts and the Lumos materials found on NovaSpark's servers.

I recommend that the litigation team schedule an internal case-strategy meeting at the earliest opportunity to prepare detailed deposition outlines organized around the specific files and communications identified in the Report. I will prepare a preliminary deposition outline for each defendant for the team's review in advance of that meeting.

C. Damages Considerations

The forensic evidence that Lumos proprietary materials were integrated into NovaSpark's development environment and actively used from as early as October through November 2022 supports a strong unjust-enrichment theory. Specifically, the evidence suggests that NovaSpark was able to achieve an accelerated time-to-market by building its product on the foundation of Lumos's proprietary technology rather than developing its own technology from scratch. The period from NovaSpark's incorporation (October 3, 2022) to the close of its $12 million seed round (November 15, 2022) was approximately six weeks—an extraordinarily short timeline that is consistent with a company presenting technology demonstrations or prototypes built on pre-existing (misappropriated) technology rather than newly developed work.

The unjust-enrichment measure of damages could encompass:

• The value of the development time and costs saved by NovaSpark through its use of Lumos's proprietary technology, which Lumos developed over more than four years at a cost of tens of millions of dollars;

• The value of the $12 million seed investment obtained by NovaSpark, to the extent that the investment was procured on the basis of technology demonstrations or capabilities derived from Lumos's trade secrets; and

• Any revenue or other economic benefits derived by NovaSpark from products or services incorporating Lumos's proprietary technology.

I recommend engaging Meridian to formalize a damages estimate based on the forensic timeline established by Brindoval, with a view toward preparing expert testimony on this topic. Naveen Kapoor has indicated that Meridian has the capability to perform such an analysis, potentially in conjunction with a financial damages expert to be retained separately.

D. Potential for Settlement Leverage

The strength of the forensic evidence, combined with the Preliminary Injunction currently in effect, provides significant leverage should the parties pursue mediation or settlement discussions. The Preliminary Injunction was granted by the Honorable David Rutherford on February 10, 2023, with the written order issued on February 17, 2023. The injunction prohibits NovaSpark and the individual defendants from using, disclosing, or distributing any Lumos proprietary materials pending final resolution of the action. The forensic evidence now available would substantially strengthen any motion for contempt or for modification of the injunction should violations be discovered, and serves as a powerful demonstration to Defendants that Lumos's claims are supported by objective, independently verified forensic proof.

I recommend discussing with the client team—specifically Priya Chandrasekaran, Chief Executive Officer of Lumos, and Thomas Brightwell, General Counsel of Lumos—whether to explore early mediation following the completion of the Anand, Mallick, and Yun depositions. The combination of the forensic evidence, the preliminary injunction, and deposition testimony may create optimal conditions for a favorable settlement that includes both monetary relief and permanent injunctive protection for Lumos's trade secrets. However, the timing and approach should be carefully considered in consultation with the client, taking into account Lumos's broader competitive and business objectives.

X. Recommended Next Steps

Based on the foregoing analysis, I recommend the following actions:

1. Circulate this memorandum to the full litigation team, consisting of Marcus Delgado (Responsible Partner), Catherine Bloom (Billing Partner), Wendy Schultz (Lead Associate), and Omar Siddiqui (Working Associate). Distribution should be limited to these individuals and should not extend beyond the litigation team without prior authorization from Mr. Delgado, consistent with the privilege and confidentiality protections applicable to this document.

2. Schedule an internal case-strategy meeting to prepare detailed deposition outlines incorporating the forensic findings from the Brindoval Report. Given that the Anand deposition is scheduled for May 15, 2023, this meeting should be convened no later than May 10, 2023. I will circulate preliminary deposition outlines for each defendant in advance of the meeting.

3. Coordinate with Naveen Kapoor of Meridian Cybersecurity Advisors to finalize the supplemental technical analysis (Appendix B) for use in depositions. We should confirm Kapoor's availability to assist with deposition preparation and, if necessary, to attend depositions in a consulting capacity. We should also discuss with Kapoor the scope and timeline for a formal expert report if expert testimony will be required at trial or in connection with any dispositive motions.

4. Prepare a client update letter for Lumos, addressed to Priya Chandrasekaran (CEO) and Thomas Brightwell (General Counsel), summarizing the forensic findings at an appropriate level of detail. The client letter should be mindful of privilege and confidentiality designations, including the terms of the March 15, 2023 Protective Order governing the treatment of confidential discovery materials in this action. We should provide sufficient detail to enable the client to appreciate the strength of the forensic evidence without disclosing specific forensic methodologies or work-product analysis that should remain within the litigation team.

5. Evaluate whether to seek additional discovery based on the coordination evidence identified in the August–September 2022 messages recovered from Defendants' personal smartphones. In particular, we should consider:

(a) Whether to serve additional written discovery on Defendants seeking all communications among the defendants and with third parties regarding the founding of NovaSpark, the acquisition of Lumos proprietary materials, and the use of such materials in NovaSpark's business;

(b) Whether to issue a third-party subpoena to Blackpine Capital Partners LP (and/or its managing partner, Franklin Osei) seeking NovaSpark's pitch materials, investor presentations, term sheets, and due-diligence materials from the seed-round investment process, to determine whether those materials referenced or relied upon Lumos technology or trade secrets; and

(c) Whether to seek leave of court for additional forensic examination of any additional devices or accounts not covered by the original Stipulation, particularly in light of the evidence that Anand's Beaumont Solutions SSD showed signs of recent formatting and that Yun's prior smartphone was disposed of through a carrier trade-in program.

XI. Appendices Referenced

The following appendices are referenced in this memorandum. Copies are maintained in the Calderwood & Harkness matter file for Matter No. 1008-00005 and are available to authorized members of the litigation team.

Appendix A: Brindoval Digital Forensics LLC, Preliminary Forensic Report (issued May 1, 2023). Full copy on file. The Report consists of 147 pages, including narrative analysis, forensic methodology documentation, chain-of-custody records, hash-value match tables, and supporting exhibits.

Appendix B: Meridian Cybersecurity Advisors Inc., Supplemental Code-Comparison Analysis (prepared by Naveen Kapoor, Senior Consultant; dated May 3, 2023). This analysis addresses the modified DataStream ETL pipeline files found on NovaSpark's corporate servers and provides Kapoor's independent conclusions regarding the nature and extent of the modifications.

Appendix C: SHA-256 Hash-Value Match Tables (extracted from the Brindoval Report and organized by defendant and trade-secret category for ease of reference). These tables provide a complete listing of all files for which SHA-256 hash-value matches were confirmed, including file names, directory paths (both Lumos originals and locations on Defendants' systems), hash values, and file sizes.

Appendix D: Timeline of Key Exfiltration Events (compiled from forensic evidence presented in the Brindoval Report). This timeline presents a chronological summary of all significant events identified through the forensic examination, from the earliest coordination communications (August 2022) through the last identified use of Lumos materials on NovaSpark's systems (January 2023).

This memorandum is intended solely for the internal use of the Calderwood & Harkness LLP litigation team assigned to the above-captioned matter. It reflects the preliminary analysis and mental impressions of the author as of the date hereof and is subject to revision as additional information becomes available.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Omar Siddiqui, Working Associate

Date: May 5, 2023

Trade Secret Category	Found on Anand Devices	Found on Mallick Devices	Found on Yun Devices	Found on NovaSpark Servers
(1) LumosEdge ML Model Architecture (neural-network topology, hyperparameters, signal-generation engine specifications)	Yes — Hollowell Health IT account; personal laptop	No	No	Yes — in active development environment
(2) Feature-Engineering Libraries (2,847 engineered features in 47 Jupyter notebooks)	No	No	Yes — Larkspur Technologies account; personal laptop	Yes — 39 of 47 notebooks in /ml-models/feature-lib/
(3) DataStream ETL Pipeline Codebase (43 vendor integrations, data-schema definitions)	No	Yes — USB drive WD-4837291; personal laptop	No	Yes — modified copies in /core-pipelines/data-ingest/
(4) Training Dataset (~14.6 TB curated dataset)	Partial references and sample subsets only	No	Partial references embedded in notebooks	Partial subsets found
(5) LumosEdge 3.0 Product Roadmap (37-page PDF, 2023–2025 specifications)	Yes — personal email; personal laptop	No	No	Yes — in /strategy/competitive-intel/

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP Attorneys at Law
Matter No.: 1008-00005 Case No.: 23-CV-004871 (Superior Court of the State of California, County of Santa Clara)
Date: May 5, 2023
INTERNAL MEMORANDUM
TO: Wendy Schultz, Lead Associate; Marcus Delgado, Responsible Partner; Catherine Bloom, Billing Partner
FROM: Omar Siddiqui, Working Associate
RE: Summary of Key Findings from Brindoval Digital Forensics LLC Preliminary Forensic Report (Issued May 1, 2023)
CONFIDENTIALITY NOTICE: This memorandum constitutes attorney work product prepared in anticipation of litigation and is protected by the work-product doctrine and the attorney-client privilege. It contains the mental impressions, conclusions, opinions, and legal theories of attorneys at Calderwood & Harkness LLP in connection with their representation of Lumos Analytics Inc. in the above-captioned matter. This memorandum is intended solely for the use of the addressees identified above and other members of the Calderwood & Harkness LLP litigation team assigned to this matter. Do not distribute outside the litigation team without prior authorization from the Responsible Partner. Any unauthorized disclosure may constitute a waiver of applicable privileges and protections.
I. Executive Summary
Brindoval Digital Forensics LLC ("Brindoval"), the neutral forensic examiner appointed by stipulation of the parties on March 8, 2023 and approved by the Honorable David Rutherford, Superior Court of the State of California, County of Santa Clara, issued its Preliminary Forensic Report on May 1, 2023 (the "Report"). The purpose of this memorandum is to provide the litigation team with a comprehensive summary of the Report's key findings, to flag the most significant evidentiary implications for our client's claims, and to set forth recommended next steps for case strategy.
At the outset, the headline conclusion is favorable and significant: the Report confirms the presence of Lumos Analytics Inc. ("Lumos") proprietary materials across NovaSpark Technologies Inc. ("NovaSpark") corporate servers and the personal devices and cloud storage accounts of all three individual defendants—Rajiv Anand, Serena Mallick, and Derek Yun. This is precisely the result we anticipated based on our client's internal audit findings, but the independent forensic confirmation by a court-approved neutral examiner carries substantial evidentiary weight that will be difficult for Defendants to challenge or dismiss.
The forensic examination was conducted between March 22, 2023 and April 14, 2023 by Dr. Irene Chow, Managing Director and Lead Forensic Examiner at Brindoval, and Kevin Barr, Senior Forensic Analyst at Brindoval. Both examiners have extensive credentials in digital forensics and are expected to be available to provide testimony regarding their findings if required. The examination encompassed corporate servers, personal laptops, personal smartphones, external storage devices, and cloud storage accounts associated with each of the individual defendants and with NovaSpark.
This memorandum was prepared in consultation with Naveen Kapoor, Senior Consultant at Meridian Cybersecurity Advisors Inc. ("Meridian"), Lumos's retained technical and cybersecurity consultant. Meridian was engaged by Calderwood & Harkness on behalf of Lumos pursuant to the engagement letter dated February 22, 2023. Kapoor independently reviewed the Report and the underlying forensic images and provided supplemental technical analysis, including a detailed code-comparison report, which is attached to this memorandum as Appendix B. Kapoor's independent review and analysis corroborate and, in certain respects, augment Brindoval's findings.
The forensic evidence substantially corroborates Lumos's allegations of misappropriation across all five categories of trade secrets identified in the Verified Complaint and at issue in this litigation:
1.  LumosEdge Ensemble ML Model Architecture — including neural-network topology definitions, hyperparameter configuration files, and signal-generation engine specifications;
2.  Proprietary Feature-Engineering Libraries — encompassing 2,847 individually engineered features used for financial signal generation, documented in Jupyter notebook format;
3.  DataStream ETL Pipeline Codebase and Data-Schema Definitions — the proprietary extract, transform, and load pipeline covering ingestion protocols and data-schema definitions for all 43 alternative-data vendors integrated into the Lumos platform;
4.  Curated Training Dataset — the approximately 14.6 terabyte training dataset developed by Lumos over a period of more than four years at a cost exceeding $7.3 million (as alleged in the Verified Complaint); and
5.  Confidential LumosEdge 3.0 Product Roadmap Documents — a 37-page internal strategy document detailing unreleased product specifications, planned features, and development milestones for the period 2023 through 2025.
As discussed in greater detail below, the forensic evidence not only confirms that Lumos's proprietary materials were taken by the individual defendants prior to their departures from Lumos, but also demonstrates that those materials were subsequently transferred to and integrated into NovaSpark's corporate development environment and actively used in NovaSpark's product development efforts. Moreover, communications recovered from the personal smartphones of Anand and Mallick reveal a coordinated scheme among all three defendants, planned as early as August 2022—well before NovaSpark's incorporation—to systematically exfiltrate the proprietary materials most relevant to each defendant's area of expertise.
The evidentiary implications are addressed in Section IX below, along with recommendations for incorporating the forensic findings into our deposition strategy and broader litigation approach.
II. Scope of Forensic Examination
A. Devices and Systems Imaged
Pursuant to the terms of the March 8, 2023 Stipulation and Order Regarding Forensic Examination (the "Stipulation"), Brindoval was authorized to image and examine the following devices, systems, and accounts. The Report confirms that all of the following were successfully imaged and examined during the examination period:
1. NovaSpark Corporate Servers. Brindoval imaged the NovaSpark corporate server environment located at NovaSpark's offices at 88 Bluxome Street, Floor 4, San Francisco, California 94107. The corporate server environment included NovaSpark's primary development server, a staging server, and associated network-attached storage. The total volume of data imaged from the corporate servers was approximately 4.7 terabytes.
2. Personal Laptops. Brindoval imaged three personal laptops belonging to each of the individual defendants:
(a) Rajiv Anand — Tidewater Industries MacBook Pro, 16-inch, 2021 model (Serial No. C02GR3XXXXX);
(b) Serena Mallick — Brightmoor Group XPS 15, 2020 model (Service Tag: HGRT7XXXXX); and
(c) Derek Yun — Tidewater Industries MacBook Pro, 14-inch, 2021 model (Serial No. C02HK8XXXXX).
3. Personal Smartphones. Brindoval imaged two personal smartphones:
(a) Rajiv Anand — Ashbury Corporation 14 Pro (IMEI: 35491XXXXXXXXX); and
(b) Serena Mallick — Northgate & Co. Galaxy S22 (IMEI: 35287XXXXXXXXX).
The Report notes that Derek Yun represented, through counsel, that he did not use a personal smartphone for work-related communications during the relevant period and that his only smartphone was replaced and recycled through a carrier trade-in program in December 2022. Defendants' counsel has represented that no forensic image of Yun's prior device is available. We should note this as a potential spoliation issue for future motion practice if warranted.
4. External Storage Drives. Brindoval imaged two external storage drives:
(a) Glenrock Industries external USB hard drive, serial number WD-4837291, identified as belonging to Serena Mallick; and
(b) Beaumont Solutions portable SSD, serial number S5NENS0XXXXX, identified as belonging to Rajiv Anand. The Report notes this drive was largely empty at the time of imaging, with evidence of recent formatting, but residual data fragments were recovered through carving analysis.
5. Cloud Storage Accounts. Brindoval obtained and examined data from the following cloud storage accounts:
(a) Rajiv Anand's personal Hollowell Health IT account (email address: r.anand.personal@vaultmail.com);
(b) Derek Yun's personal Larkspur Technologies account (email address: d.yun.private@Greaves Systems.com); and
(c) NovaSpark's corporate cloud repositories, including a Tidewater Solutions organization account and an Ridgeway Industries (Meridian Technologies) S3 storage bucket associated with NovaSpark's development environment.
B. Methodology
The Report describes the forensic examination methodology employed by Brindoval in detail at Section 3 of the Report. For the purposes of this memorandum, the key methodological elements are summarized as follows:
1. Forensic Imaging. All devices and storage media were imaged using industry-standard bit-for-bit imaging protocols, specifically using the Calderon Technologies and Stonefield Software imaging tools. Each forensic image was verified against the original media using SHA-256 hash verification to ensure data integrity. Chain of custody was maintained throughout the imaging and examination process in accordance with the procedures specified in the Stipulation. Brindoval's chain-of-custody documentation is included as Exhibit 2 to the Report.
2. File-Matching Analysis. The core of Brindoval's analysis involved SHA-256 hash-value comparison of files found on Defendants' devices and systems against Lumos-provided reference copies of its proprietary materials. Lumos provided Brindoval with a reference set of proprietary files on March 20, 2023, two days prior to the commencement of the examination, in accordance with the timeline set forth in the Stipulation. The reference set was delivered on encrypted media and included the complete LumosEdge source code repository, the DataStream ETL pipeline repository, the feature-engineering library (Jupyter notebooks), sample subsets of the training dataset, and the LumosEdge 3.0 Product Roadmap document. Hash-value matching provides a mathematically certain confirmation that two files are identical at the byte level; the probability of a false positive (i.e., two different files producing the same SHA-256 hash) is astronomically low (approximately 1 in 2^256).
3. Timestamp and Metadata Analysis. Brindoval conducted detailed analysis of file creation dates, modification dates, and last-access dates for all files of interest. Metadata embedded within the files—including authorship information, internal directory paths, project tags, and version-control metadata—was also analyzed. This analysis was critical to establishing the timeline of exfiltration events and the subsequent movement of files from personal devices and accounts to NovaSpark's corporate systems.
4. Transfer and Connection Log Analysis. Brindoval analyzed file-transfer logs, browser download histories, USB device-connection logs (from both Lumos-issued and personal devices), and cloud synchronization records to reconstruct the methods and timing of data transfers. This analysis included examination of Windows Event Logs, macOS Unified Logs, and application-specific logs for Hollowell Health IT, Larkspur Technologies, and other cloud services.
5. Email and Messaging Artifact Recovery. Brindoval recovered email artifacts from personal devices, including locally cached email messages, and messaging application records from personal smartphones. The messaging artifacts included text messages (SMS and Westmark Software) and records from the signal encrypted messaging application. The Report notes that while signal message content was recoverable in certain instances due to local device storage, the recovery was partial and some message threads may be incomplete.
C. Parties' Agreed Framework
Brindoval was appointed pursuant to the March 8, 2023 Stipulation and Order Regarding Forensic Examination, which was negotiated between the parties and submitted to the Court for approval. The Stipulation was signed by Marcus Delgado on behalf of Lumos and by Patricia Whitfield of Whitfield, Raines & Gerber LLP on behalf of Defendants. The Honorable David Rutherford signed the corresponding Order on March 10, 2023, formally appointing Brindoval and establishing the framework for the examination.
The total fees for the Brindoval forensic examination, as set forth in the Report, are $218,600. Pursuant to the cost-allocation provisions of the Stipulation, these fees are allocated sixty percent (60%) to Defendants and NovaSpark, in the amount of $131,160, and forty percent (40%) to Lumos, in the amount of $87,440. The cost-allocation provision was a negotiated compromise; Defendants initially sought a 50/50 split, while Lumos argued that Defendants should bear 100% of the costs given that the examination was necessitated by Defendants' alleged misconduct. The 60/40 allocation reflects the Court's suggestion during the March 6, 2023 case management conference.
Both parties' counsel received the Report simultaneously on May 1, 2023, in accordance with the Stipulation's provisions regarding simultaneous disclosure. The Report was transmitted via Brindoval's secure document portal, and confirmation of receipt was acknowledged by both Calderwood & Harkness and Whitfield, Raines & Gerber on the same date.
III. Key Findings — Rajiv Anand
Rajiv Anand served as Vice President of Machine Learning at Lumos from June 2019 through his resignation on October 14, 2022. In his role, Anand had broad access to the LumosEdge model architecture, training datasets, and product strategy materials. He subsequently joined NovaSpark as its Co-Founder and Chief Technology Officer. The forensic evidence pertaining to Anand is among the most significant in the Report and is summarized below.
A. Hollowell Health IT Exfiltration (September 26, 2022)
Brindoval confirmed that on September 26, 2022—approximately eighteen days before Anand's resignation from Lumos—approximately 3.2 gigabytes of files were transferred from Anand's Lumos-issued workstation (a Brightmoor Group Precision 5560 mobile workstation, asset tag LUM-WS-4471) to a personal Hollowell Health IT account. The Hollowell Health IT account was authenticated under Anand's personal credentials, associated with the email address r.anand.personal@vaultmail.com. The transfer was accomplished via the Hollowell Health IT desktop synchronization client, which Anand had installed on his Lumos-issued workstation. Brindoval's analysis of the Hollowell Health IT sync logs, recovered from the Lumos workstation's local application data directory, confirmed the timing and volume of the transfer.
File-matching analysis yielded significant results. SHA-256 hash values of eighty-seven (87) individual files found in the Hollowell Health IT account matched corresponding files in the Lumos proprietary codebase reference set provided to Brindoval. The matched files were not trivial or generic in nature; rather, they constitute core components of the LumosEdge system.
Specifically, the content of the transferred files includes:
•  LumosEdge ensemble machine-learning model architecture specifications, including the full model definition files for the proprietary ensemble of gradient-boosted decision trees and deep neural networks that form the backbone of Lumos's signal-generation engine;
•  Neural-network topology configuration files, specifying layer structures, activation functions, attention mechanisms, and interconnection architectures for the deep-learning components of the LumosEdge system;
•  Hyperparameter configuration files, containing the precise tuning parameters (learning rates, regularization coefficients, batch sizes, dropout rates, ensemble weighting schemes, and related parameters) that Lumos developed through extensive experimentation and computational investment over a period of more than two years; and
•  Supporting documentation files, including internal design memoranda and technical notes authored by members of the Lumos ML engineering team under Anand's supervision.
These files collectively constitute the core of the LumosEdge signal-generation engine and represent what Lumos has identified in its trade-secret disclosure as among its most valuable and competitively sensitive proprietary assets.
Metadata analysis further strengthens the evidentiary picture. The files found in Anand's Hollowell Health IT account retain their original Lumos internal directory path structures (e.g., /lumos/lumosedge/models/ensemble/v2.7/, /lumos/lumosedge/config/hyperparams/) and authorship metadata, including Lumos employee IDs and internal project tags (e.g., "PROJ-EDGE-2022," "TEAM-ML-CORE"). The preservation of this metadata is significant because it eliminates any argument that the files were independently created or derived from publicly available sources; the files bear unambiguous markers of their Lumos origin.
B. LumosEdge 3.0 Product Roadmap (September 28, 2022)
Two days after the Hollowell Health IT transfer, on September 28, 2022, Anand took a separate action to exfiltrate Lumos's confidential strategic planning materials. Brindoval confirmed that on that date, Anand forwarded the confidential "LumosEdge 3.0 Product Roadmap" from his Lumos corporate email account (r.anand@lumos-analytics.com) to his personal email address, r.anand.personal@vaultmail.com. The email was sent at approximately 11:42 PM Pacific Time, outside of normal business hours.
The LumosEdge 3.0 Product Roadmap is a 37-page PDF document, bearing the header "CONFIDENTIAL — LUMOS ANALYTICS INC. — DO NOT DISTRIBUTE" on each page. It was prepared by Lumos's product strategy team in August 2022 and distributed internally on a need-to-know basis. The roadmap contains unreleased product specifications for LumosEdge 3.0, the next major version of Lumos's flagship product, covering planned features, architectural enhancements, new data-source integrations, target client segments, development milestones, and projected timelines for the period 2023 through 2025. As alleged in the Verified Complaint, this document represents a comprehensive blueprint for Lumos's future competitive direction.
Brindoval recovered a copy of the PDF from Anand's personal laptop during the forensic imaging process. Additionally, and of particular significance, the same document was located on NovaSpark's corporate servers in a directory labeled "/strategy/competitive-intel/". The directory name itself is notable, as it suggests that NovaSpark categorized and stored the Lumos roadmap as "competitive intelligence"—acknowledging its competitive significance while simultaneously evidencing deliberate use of a competitor's confidential materials.
SHA-256 hash-value comparison confirmed that the copy of the document found on NovaSpark's corporate servers is byte-for-byte identical to the Lumos original provided in the reference set. There are no modifications, redactions, or alterations of any kind. NovaSpark possesses an exact duplicate of Lumos's most sensitive forward-looking strategic document.
C. Presence on NovaSpark Systems
Beyond the roadmap document, Brindoval's examination of NovaSpark's corporate servers revealed that portions of the LumosEdge model architecture files—the same files transferred to Anand's Hollowell Health IT on September 26, 2022—were found integrated into NovaSpark's active development environment. These files were not simply stored in a passive archive; they were located within NovaSpark's working source-code repositories and showed evidence of being incorporated into NovaSpark's own product codebase.
Timestamp analysis indicates that these files were first copied to NovaSpark's systems on or around October 8, 2022. This date is significant for several reasons: it is only five days after NovaSpark's October 3, 2022 incorporation in the State of Delaware, suggesting that the transfer of Lumos's proprietary technology was among the very first substantive activities undertaken by the newly formed company. It is also six days before Anand's formal resignation from Lumos on October 14, 2022, raising the additional issue of whether Anand was actively building NovaSpark's technology platform using Lumos's trade secrets while still employed by Lumos—a fact directly relevant to the breach-of-duty-of-loyalty claim.
Brindoval's analysis of Anand's Hollowell Health IT sync logs corroborates the transfer pathway. The logs show that the files in question were accessed from a device matching the MAC address of a NovaSpark-issued laptop assigned to Anand (MAC address: A4:83:E7:XX:XX:XX), indicating that Anand used his NovaSpark device to download the files from his personal Hollowell Health IT and subsequently uploaded or copied them to NovaSpark's corporate development servers. This establishes a clear chain of custody for the misappropriated materials: Lumos workstation → personal Hollowell Health IT → NovaSpark laptop → NovaSpark corporate servers.
IV. Key Findings — Serena Mallick
Serena Mallick served as a Senior Data Engineer at Lumos from March 2020 through her resignation on October 14, 2022 (the same date as Anand's resignation—a coincidence that the coordination evidence discussed in Section VI below reveals was not coincidental at all). In her role, Mallick was the primary architect and lead developer of the DataStream ETL pipeline, Lumos's proprietary system for ingesting, transforming, and loading alternative data from third-party vendors. She subsequently joined NovaSpark as Vice President of Engineering on October 17, 2022, only three days after her departure from Lumos. The forensic evidence pertaining to Mallick centers on the exfiltration of the DataStream ETL pipeline codebase.
A. USB Drive Exfiltration (October 10, 2022)
Brindoval imaged the external USB hard drive bearing serial number WD-4837291, a Glenrock Industries Elements portable drive with a storage capacity of 2 terabytes. The drive was confirmed as belonging to Mallick based on purchase records subpoenaed from Glenrock Industries and corroborated by Mallick's own identification of the drive during the imaging session conducted pursuant to the Stipulation.
The forensic image of USB drive WD-4837291 revealed that the drive contained a complete clone of the DataStream ETL pipeline repository, totaling approximately 780 megabytes of source code, configuration files, data-schema definitions, documentation, and associated build scripts. SHA-256 hash-value comparison of the repository files against the Lumos reference copy confirmed a match across all 1,247 individual source files contained in the repository. The match rate was 100%—every single file on the USB drive corresponding to the DataStream repository was identical to its Lumos counterpart. This is not a case of partial or fragmentary copying; Mallick took a complete, fully functional copy of the entire DataStream system.
The DataStream ETL pipeline codebase is a proprietary and highly valuable component of Lumos's technology platform. It includes:
•  The core extract, transform, and load processing engine, written primarily in Python and Scala;
•  Proprietary data-schema definitions covering the ingestion protocols, data-normalization rules, and transformation logic for all 43 alternative-data vendors integrated into Lumos's platform, including providers of satellite imagery data, web-scraping data, credit-card transaction data, geolocation data, and other non-traditional data sources used in quantitative financial analysis;
•  Vendor-specific API integration modules, each customized to the unique data formats, authentication protocols, delivery mechanisms, and rate-limiting constraints of the respective vendors;
•  Data-quality validation and anomaly-detection routines developed over more than two years of iterative refinement; and
•  Comprehensive internal documentation, including architecture diagrams, data-flow specifications, and developer guides.
Critically, Brindoval's analysis of USB device-connection logs recovered from Mallick's Lumos-issued workstation (a Lenovo ThinkPad X1 Carbon, asset tag LUM-WS-5923) confirms the precise timing of the exfiltration. The logs show that USB drive WD-4837291 was connected to the Lumos workstation on October 10, 2022 at 9:47 PM Pacific Time. A bulk file-copy operation was initiated at 9:52 PM and completed at 10:14 PM—a window of approximately twenty-two minutes during which the entire 780 MB repository was copied to the external drive. The late hour of this activity (nearly 10:00 PM on a weekday evening) is consistent with a deliberate effort to conduct the exfiltration outside of normal business hours and away from the observation of colleagues. October 10, 2022 was four days before Mallick's October 14 resignation from Lumos.
B. Presence on NovaSpark Systems
Brindoval identified the DataStream ETL pipeline codebase on NovaSpark's corporate development servers, located in a directory labeled "/core-pipelines/data-ingest/". The presence of the complete DataStream system on NovaSpark's servers is direct evidence that the misappropriated materials were not merely taken but were actively deployed in NovaSpark's product development.
File metadata analysis indicates that these files were first uploaded to NovaSpark's systems on October 19, 2022—only two days after Mallick commenced her employment at NovaSpark as Vice President of Engineering on October 17, 2022. The rapidity with which the Lumos materials appeared on NovaSpark's servers after Mallick's first day of employment at NovaSpark further corroborates the pre-planned nature of the misappropriation.
Brindoval and Meridian's analyses both confirm that portions of the DataStream code found on NovaSpark's servers had been modified relative to the Lumos originals. However, Naveen Kapoor's independent code-comparison analysis (Appendix B) conclusively demonstrates that these modifications were cosmetic in nature. Specifically, the modifications consisted of:
•  Renaming of variables and function names (e.g., changing "lumosetlprocessor" to "novadatapipeline," renaming internal module references from "datastream" to "novastream");
•  Stripping of comments and internal documentation headers that contained Lumos-specific references, copyright notices, and attribution information;
•  Minor reformatting of code (e.g., changes to indentation style, line-break conventions); and
•  Replacement of Lumos-branded configuration labels with NovaSpark-branded equivalents.
Despite these surface-level changes, the underlying algorithmic logic, data-schema structures, pipeline architecture, processing sequences, error-handling routines, and vendor-specific integration protocols remain substantively identical to Lumos's proprietary DataStream system. Kapoor's report characterizes the modifications as a deliberate but superficial attempt to disguise the provenance of the code—what is colloquially referred to in the software industry as "code laundering." The substantive identity of the two codebases is unmistakable to any qualified examiner.
V. Key Findings — Derek Yun
Derek Yun served as a Machine Learning Engineer at Lumos from January 2021 through his resignation on October 21, 2022. In his role, Yun was responsible for developing and maintaining Lumos's proprietary feature-engineering libraries—the extensive collection of engineered features used to transform raw alternative data into predictive signals for the LumosEdge platform. He subsequently joined NovaSpark as a Founding Engineer on October 24, 2022, only three days after his departure from Lumos. The forensic evidence pertaining to Yun centers on the exfiltration of the feature-engineering libraries.
A. Larkspur Technologies Exfiltration (October 18, 2022)
Brindoval confirmed that on October 18, 2022, forty-seven (47) proprietary Jupyter notebooks were downloaded from Lumos's internal code repository (a self-hosted Aldermere Software instance) and synced to Yun's personal Larkspur Technologies account, associated with the email address d.yun.private@Greaves Systems.com. The download was conducted from Yun's Lumos-issued workstation (an Tidewater Industries MacBook Pro, 16-inch, 2021 model, asset tag LUM-WS-6187), and the files were transferred to Yun's personal Larkspur Technologies via the Larkspur Technologies desktop synchronization client installed on the workstation.
These 47 Jupyter notebooks contain feature-engineering code and model-training scripts that together encompass significant portions of Lumos's proprietary library of 2,847 engineered features for financial signal generation. Each notebook represents a substantial body of proprietary work, containing not only executable code but also extensive inline documentation explaining the rationale, data-science methodology, and empirical validation results for the features defined therein. The feature-engineering library is the product of years of research and experimentation by Lumos's data science team and represents one of the company's most competitively significant assets—the engineered features are, in essence, the "secret sauce" that allows LumosEdge to generate predictive financial signals from raw alternative data.
SHA-256 hash-value matching confirmed that all 47 of 47 notebooks found in Yun's Larkspur Technologies account are identical to the corresponding Lumos originals in the reference set. The match is complete and unambiguous—there is no question that the files in Yun's Larkspur Technologies are exact copies of Lumos proprietary materials.
Larkspur Technologies sync metadata records the upload timestamp as October 18, 2022 at 6:23 PM Pacific Time. This date is notable because it falls three days before Yun's October 21, 2022 resignation from Lumos. As with the Anand and Mallick exfiltrations, the timing is consistent with a deliberate pre-departure plan to extract proprietary materials before giving notice.
B. Presence on NovaSpark Systems
Brindoval's examination of NovaSpark's corporate development servers revealed that 39 of the 47 exfiltrated Jupyter notebooks were present on NovaSpark's servers, located in a directory labeled "/ml-models/feature-lib/". The fact that 39 of 47 notebooks (approximately 83%) were transferred to NovaSpark's systems indicates extensive, though not complete, incorporation of the Lumos feature-engineering library into NovaSpark's development environment. The eight notebooks not found on NovaSpark's servers may have been excluded because they pertained to data sources or feature categories that NovaSpark chose not to replicate, or they may have been stored elsewhere on NovaSpark's systems in a location not captured by Brindoval's examination—a possibility that warrants further investigation.
Timestamp analysis indicates that these 39 files were first uploaded to NovaSpark's systems on October 26, 2022—two days after Yun commenced employment at NovaSpark as a founding engineer on October 24, 2022. This pattern is remarkably consistent across all three defendants: in each case, Lumos proprietary materials appeared on NovaSpark's corporate systems within days of the respective defendant's start date at NovaSpark, strongly suggesting that the transfer of misappropriated materials was a primary objective of each defendant's initial activities at the company.
Of particular significance, several of the Jupyter notebooks found on NovaSpark's servers showed evidence of active use and modification within NovaSpark's development environment. Specifically, Brindoval identified execution logs associated with the notebooks dating from November 2022 through January 2023, indicating that the Lumos feature-engineering code was not merely stored passively but was actively run, tested, and iterated upon by NovaSpark personnel during this period. This evidence of active use is directly relevant to our damages theory, as it demonstrates that NovaSpark derived tangible benefit from the misappropriated materials in furtherance of its own product development.
VI. Cross-Referencing and Coordination Evidence
Perhaps the most damaging category of evidence identified in the Report—from the perspective of Defendants' potential defenses—is the coordination evidence recovered from the personal smartphones of Rajiv Anand and Serena Mallick. This evidence transforms the narrative from one of three potentially independent acts of misappropriation into a single, coordinated scheme orchestrated in advance by all three defendants acting in concert.
Brindoval identified communications—consisting of text messages (SMS and Westmark Software) and messaging-application records (Harborline Technologies)—recovered from Anand's Ashbury Corporation 14 Pro and Mallick's Northgate & Co. Galaxy S22 that demonstrate explicit coordination among all three defendants regarding the timing of their departures from Lumos and the specific types of proprietary materials to be taken by each individual.
The recovered messages show that the coordination began as early as August 2022, approximately two months before any of the defendants resigned from Lumos. Messages from this period discuss the founding of a competing venture, reference specific Lumos technologies by their internal project code names (including "EDGE" for the LumosEdge platform, "DSTREAM" for the DataStream ETL pipeline, and "FEATLIB" for the feature-engineering library), and outline the respective roles each defendant would play in the new venture.
One message is particularly significant. On September 15, 2022, Anand sent a message to Mallick and Yun in a group message thread. The message states, in substance, that each individual should "secure" the materials most relevant to their respective areas of expertise before departing from Lumos. While the exact language of the message is set forth in the Report and should be reviewed in its entirety by the litigation team, the substance of the instruction is clear: Anand directed each defendant to systematically exfiltrate the Lumos proprietary materials within their respective domains of responsibility—the model architecture for Anand, the ETL pipeline for Mallick, and the feature-engineering library for Yun.
The timeline of the coordination evidence is also significant in the broader context of NovaSpark's formation and funding. The messages predate NovaSpark's October 3, 2022 incorporation in the State of Delaware, indicating that the plan to misappropriate Lumos's trade secrets was conceived before NovaSpark even existed as a legal entity. The messages also predate the November 15, 2022 close of NovaSpark's $12 million seed funding round from Blackpine Capital Partners LP, a venture capital fund managed by Franklin Osei. This raises the additional question—which may warrant further discovery—of whether NovaSpark's pitch materials to Blackpine referenced or relied upon Lumos technology, and whether Blackpine was aware of the provenance of NovaSpark's technology when it committed to the investment.
The coordination evidence substantially undermines any potential defense of inadvertent or incidental possession. Defendants cannot credibly argue that the presence of Lumos materials on their personal devices or on NovaSpark's servers was the result of accident, mistake, or routine backup practices. The September 15 message alone—directing each defendant to "secure" specific categories of materials—constitutes powerful evidence of willful and malicious misappropriation, a finding that would support an award of exemplary damages under California Civil Code § 3426.3(c).
VII. Summary of Proprietary Material Categories Found on Defendants' Systems
The following table summarizes, by trade-secret category, where Lumos proprietary materials were identified by Brindoval during the forensic examination:
Several observations merit emphasis based on this summary:
First, the division of exfiltrated materials maps precisely to each defendant's area of expertise and responsibility at Lumos: Anand took the ML model architecture (his domain as VP of Machine Learning); Mallick took the DataStream ETL pipeline (her domain as the primary architect of that system); and Yun took the feature-engineering libraries (his domain as a Machine Learning Engineer focused on feature development). This pattern is entirely consistent with the coordinated scheme revealed by the messaging evidence discussed in Section VI.
Second, all five categories of trade secrets at issue in this litigation are represented across the Defendants' collective systems, with materials from four of the five categories confirmed present on NovaSpark's corporate servers. The only category not found in its entirety is the training dataset (Category 4), which is unsurprising given its massive size (14.6 TB); however, partial subsets and references were found, indicating that Defendants accessed or utilized portions of the dataset.
Third, the presence of materials on NovaSpark's corporate servers—as distinguished from merely on the individual defendants' personal devices—is critically important. It establishes NovaSpark's direct involvement in the misappropriation and supports our claims against the corporate entity, not only against the individual defendants.
VIII. Meridian Cybersecurity Advisors — Independent Assessment
Naveen Kapoor, Senior Consultant at Meridian Cybersecurity Advisors Inc. (located at 2100 Geng Road, Suite 210, Palo Alto, California 94303), independently reviewed the Brindoval Report and the underlying forensic images pursuant to Meridian's engagement by Calderwood & Harkness on behalf of Lumos. Kapoor holds a Master of Science in Computer Science from Stanford University and has over fifteen years of experience in digital forensics, cybersecurity, and intellectual property litigation support. His qualifications are detailed in Meridian's engagement letter and curriculum vitae on file with the firm.
Kapoor's independent assessment, delivered to Calderwood & Harkness on May 3, 2023 (Appendix B), provides the following key conclusions:
1. Validation of Methodology. Kapoor confirms that Brindoval's file-matching methodology is sound and consistent with industry best practices for digital forensic examination. The use of SHA-256 hash-value comparison is the accepted standard for file-identity verification in forensic contexts, and Brindoval's implementation of that methodology, as described in the Report, is technically rigorous.
2. Reliability of Hash-Value Comparisons. Kapoor confirms that the hash-value comparisons reported by Brindoval are reliable and that the matched files are, with mathematical certainty, identical to the Lumos originals. There is no reasonable basis to challenge the accuracy of the file-matching results.
3. Consistency of Timestamp Evidence. Kapoor confirms that the timestamp evidence presented in the Report is internally consistent. The file creation dates, modification dates, sync timestamps, and device-connection logs all corroborate one another and are consistent with the exfiltration timeline described in the Report. Kapoor found no evidence of timestamp manipulation or inconsistencies that would undermine the reliability of the chronological reconstruction.
4. Supplemental Code-Comparison Analysis. Kapoor conducted a detailed supplemental code-comparison analysis on the modified DataStream ETL pipeline files found on NovaSpark's corporate development servers. This analysis employed both automated comparison tools (including structural code-similarity analysis using abstract syntax tree comparison) and manual expert review. Kapoor's conclusions are unequivocal: the modifications made to the DataStream code on NovaSpark's servers were cosmetic in nature, consisting of the renaming of variables and functions, the stripping of comments and internal documentation headers bearing Lumos attribution, and minor formatting changes. The underlying algorithmic logic, data-schema structures, pipeline architecture, processing sequences, error-handling routines, and vendor-specific integration protocols are substantively identical to Lumos's proprietary DataStream system. Kapoor quantifies the structural code similarity at approximately 97.3% based on abstract syntax tree comparison, with the remaining 2.7% attributable to the cosmetic modifications described above.
5. Lumos-Specific Internal Identifiers on NovaSpark Systems. Kapoor's analysis further identified an additional category of evidence not specifically highlighted in the Brindoval Report. Certain NovaSpark development logs—including build logs, test execution records, and developer commit messages within NovaSpark's version-control system—reference Lumos-specific internal identifiers. These include:
(a) Internal project code names used exclusively within Lumos (e.g., "DSTREAM-v4.2," "EDGE-ENSEMBLE-RC1");
(b) Vendor API keys belonging to Lumos, which appear to have been inadvertently carried over from the misappropriated DataStream codebase and used during NovaSpark's development and testing activities—a finding that not only evidences the use of Lumos materials but also potentially implicates unauthorized access to third-party data vendor systems using Lumos's credentials; and
(c) References to Lumos internal documentation URLs and confluence wiki page identifiers in developer notes and commit messages.
These residual Lumos-specific identifiers provide additional, independent evidence that NovaSpark's product development incorporated Lumos proprietary materials. They are the digital equivalent of fingerprints left behind despite an attempt to wipe down the scene—traces of origin that the cosmetic code modifications failed to eliminate.
Kapoor's full supplemental analysis is attached as Appendix B and should be reviewed by the litigation team in its entirety. Kapoor has indicated that he is available to expand his analysis into a formal expert report suitable for submission to the Court if the team determines that expert testimony will be required.
IX. Implications for Litigation Strategy
A. Strengthening of Claims
The forensic evidence documented in the Brindoval Report and corroborated by Meridian's independent analysis strongly supports all five causes of action set forth in the Verified Complaint filed on January 18, 2023:
(1) Trade Secret Misappropriation under the California Uniform Trade Secrets Act (Cal. Civ. Code §§ 3426–3426.11). The Report provides direct evidence of both "acquisition" of Lumos trade secrets by improper means (unauthorized copying and exfiltration) and "use" of those trade secrets by NovaSpark (integration into NovaSpark's development environment and active deployment in product development). The coordination evidence, particularly the September 15, 2022 directive to "secure" specific materials, establishes that the acquisition was accomplished through willful and deliberate misconduct, supporting a claim for exemplary damages under Section 3426.3(c) in an amount up to twice the compensatory damages award.
(2) Breach of Contract (Proprietary Information and Inventions Assignment Agreement). Each of the three individual defendants executed a Proprietary Information and Inventions Assignment Agreement ("PIIAA") upon commencing employment at Lumos. Each PIIAA contains restrictive covenant provisions, including a confidentiality and non-disclosure provision that expressly survives termination of employment for a period of three years. The PIIAAs also include a covenant not to use or disclose Lumos trade secrets or confidential information at any time, without temporal limitation. The forensic evidence provides conclusive proof that each defendant breached these contractual obligations by copying, retaining, and transferring Lumos proprietary materials to NovaSpark for use in a competing product.
(3) Breach of Duty of Loyalty. The timestamp evidence is particularly relevant to this claim. The forensic record shows that Anand and Mallick exfiltrated Lumos materials while still employed by Lumos (Anand on September 26 and 28, 2022; Mallick on October 10, 2022; both resigned October 14, 2022). Yun exfiltrated materials on October 18, 2022, three days before his October 21 resignation. Moreover, the coordination evidence shows that all three defendants were planning a competing venture as early as August 2022 while still receiving compensation from Lumos—a clear breach of the common-law duty of loyalty owed by employees to their employer.
(4) Unfair Business Practices under California Business and Professions Code § 17200. NovaSpark's use of misappropriated trade secrets to develop a competing product and secure $12 million in venture funding constitutes an unfair and unlawful business practice within the meaning of Section 17200. The forensic evidence establishes the factual predicate for this claim with particular strength.
(5) Conversion. The physical taking of proprietary materials—including the complete cloning of the DataStream repository to a USB drive and the downloading of Jupyter notebooks—supports the conversion claim. While conversion claims in the trade-secret context can be legally complex, the forensic evidence of specific, identifiable property (files with unique hash values) taken from Lumos's possession strengthens this cause of action.
In addition to the affirmative strength of Lumos's claims, the coordination evidence recovered from Anand's and Mallick's personal smartphones substantially undermines any potential defense of inadvertent or incidental possession. The messaging evidence demonstrates premeditation, deliberate planning, and coordinated execution of the misappropriation scheme, eliminating the possibility that the defendants might credibly claim that Lumos materials ended up on their personal devices or on NovaSpark's servers through accident, routine backup practices, or any other innocent explanation.
B. Upcoming Depositions
The forensic findings from the Report should be deployed strategically at the upcoming depositions of each individual defendant. The current deposition schedule is as follows:
•  Rajiv Anand — deposition scheduled for May 15, 2023;
•  Serena Mallick — deposition scheduled for June 7, 2023; and
•  Derek Yun — deposition scheduled for June 22, 2023.
Each deposition should be structured to confront the respective defendant with the specific files, timestamps, and communications identified in the Report. The forensic evidence provides a powerful tool for locking each defendant into a factual record regarding the exfiltration events, the transfer of materials to NovaSpark, and the coordination among the defendants. Key objectives for each deposition should include:
•  Establishing each defendant's knowledge of the confidential and proprietary nature of the materials taken;
•  Confirming the authenticity of the recovered communications and obtaining admissions regarding the coordination scheme;
•  Exploring each defendant's account of the purpose and circumstances of the file transfers;
•  Identifying any additional individuals at NovaSpark (beyond the three defendants) who accessed or used the misappropriated materials; and
•  Probing the relationship between NovaSpark's product development efforts and the Lumos materials found on NovaSpark's servers.
I recommend that the litigation team schedule an internal case-strategy meeting at the earliest opportunity to prepare detailed deposition outlines organized around the specific files and communications identified in the Report. I will prepare a preliminary deposition outline for each defendant for the team's review in advance of that meeting.
C. Damages Considerations
The forensic evidence that Lumos proprietary materials were integrated into NovaSpark's development environment and actively used from as early as October through November 2022 supports a strong unjust-enrichment theory. Specifically, the evidence suggests that NovaSpark was able to achieve an accelerated time-to-market by building its product on the foundation of Lumos's proprietary technology rather than developing its own technology from scratch. The period from NovaSpark's incorporation (October 3, 2022) to the close of its $12 million seed round (November 15, 2022) was approximately six weeks—an extraordinarily short timeline that is consistent with a company presenting technology demonstrations or prototypes built on pre-existing (misappropriated) technology rather than newly developed work.
The unjust-enrichment measure of damages could encompass:
•  The value of the development time and costs saved by NovaSpark through its use of Lumos's proprietary technology, which Lumos developed over more than four years at a cost of tens of millions of dollars;
•  The value of the $12 million seed investment obtained by NovaSpark, to the extent that the investment was procured on the basis of technology demonstrations or capabilities derived from Lumos's trade secrets; and
•  Any revenue or other economic benefits derived by NovaSpark from products or services incorporating Lumos's proprietary technology.
I recommend engaging Meridian to formalize a damages estimate based on the forensic timeline established by Brindoval, with a view toward preparing expert testimony on this topic. Naveen Kapoor has indicated that Meridian has the capability to perform such an analysis, potentially in conjunction with a financial damages expert to be retained separately.
D. Potential for Settlement Leverage
The strength of the forensic evidence, combined with the Preliminary Injunction currently in effect, provides significant leverage should the parties pursue mediation or settlement discussions. The Preliminary Injunction was granted by the Honorable David Rutherford on February 10, 2023, with the written order issued on February 17, 2023. The injunction prohibits NovaSpark and the individual defendants from using, disclosing, or distributing any Lumos proprietary materials pending final resolution of the action. The forensic evidence now available would substantially strengthen any motion for contempt or for modification of the injunction should violations be discovered, and serves as a powerful demonstration to Defendants that Lumos's claims are supported by objective, independently verified forensic proof.
I recommend discussing with the client team—specifically Priya Chandrasekaran, Chief Executive Officer of Lumos, and Thomas Brightwell, General Counsel of Lumos—whether to explore early mediation following the completion of the Anand, Mallick, and Yun depositions. The combination of the forensic evidence, the preliminary injunction, and deposition testimony may create optimal conditions for a favorable settlement that includes both monetary relief and permanent injunctive protection for Lumos's trade secrets. However, the timing and approach should be carefully considered in consultation with the client, taking into account Lumos's broader competitive and business objectives.
X. Recommended Next Steps
Based on the foregoing analysis, I recommend the following actions:
1.  Circulate this memorandum to the full litigation team, consisting of Marcus Delgado (Responsible Partner), Catherine Bloom (Billing Partner), Wendy Schultz (Lead Associate), and Omar Siddiqui (Working Associate). Distribution should be limited to these individuals and should not extend beyond the litigation team without prior authorization from Mr. Delgado, consistent with the privilege and confidentiality protections applicable to this document.
2.  Schedule an internal case-strategy meeting to prepare detailed deposition outlines incorporating the forensic findings from the Brindoval Report. Given that the Anand deposition is scheduled for May 15, 2023, this meeting should be convened no later than May 10, 2023. I will circulate preliminary deposition outlines for each defendant in advance of the meeting.
3.  Coordinate with Naveen Kapoor of Meridian Cybersecurity Advisors to finalize the supplemental technical analysis (Appendix B) for use in depositions. We should confirm Kapoor's availability to assist with deposition preparation and, if necessary, to attend depositions in a consulting capacity. We should also discuss with Kapoor the scope and timeline for a formal expert report if expert testimony will be required at trial or in connection with any dispositive motions.
4.  Prepare a client update letter for Lumos, addressed to Priya Chandrasekaran (CEO) and Thomas Brightwell (General Counsel), summarizing the forensic findings at an appropriate level of detail. The client letter should be mindful of privilege and confidentiality designations, including the terms of the March 15, 2023 Protective Order governing the treatment of confidential discovery materials in this action. We should provide sufficient detail to enable the client to appreciate the strength of the forensic evidence without disclosing specific forensic methodologies or work-product analysis that should remain within the litigation team.
5.  Evaluate whether to seek additional discovery based on the coordination evidence identified in the August–September 2022 messages recovered from Defendants' personal smartphones. In particular, we should consider:
(a) Whether to serve additional written discovery on Defendants seeking all communications among the defendants and with third parties regarding the founding of NovaSpark, the acquisition of Lumos proprietary materials, and the use of such materials in NovaSpark's business;
(b) Whether to issue a third-party subpoena to Blackpine Capital Partners LP (and/or its managing partner, Franklin Osei) seeking NovaSpark's pitch materials, investor presentations, term sheets, and due-diligence materials from the seed-round investment process, to determine whether those materials referenced or relied upon Lumos technology or trade secrets; and
(c) Whether to seek leave of court for additional forensic examination of any additional devices or accounts not covered by the original Stipulation, particularly in light of the evidence that Anand's Beaumont Solutions SSD showed signs of recent formatting and that Yun's prior smartphone was disposed of through a carrier trade-in program.
XI. Appendices Referenced
The following appendices are referenced in this memorandum. Copies are maintained in the Calderwood & Harkness matter file for Matter No. 1008-00005 and are available to authorized members of the litigation team.
Appendix A: Brindoval Digital Forensics LLC, Preliminary Forensic Report (issued May 1, 2023). Full copy on file. The Report consists of 147 pages, including narrative analysis, forensic methodology documentation, chain-of-custody records, hash-value match tables, and supporting exhibits.
Appendix B: Meridian Cybersecurity Advisors Inc., Supplemental Code-Comparison Analysis (prepared by Naveen Kapoor, Senior Consultant; dated May 3, 2023). This analysis addresses the modified DataStream ETL pipeline files found on NovaSpark's corporate servers and provides Kapoor's independent conclusions regarding the nature and extent of the modifications.
Appendix C: SHA-256 Hash-Value Match Tables (extracted from the Brindoval Report and organized by defendant and trade-secret category for ease of reference). These tables provide a complete listing of all files for which SHA-256 hash-value matches were confirmed, including file names, directory paths (both Lumos originals and locations on Defendants' systems), hash values, and file sizes.
Appendix D: Timeline of Key Exfiltration Events (compiled from forensic evidence presented in the Brindoval Report). This timeline presents a chronological summary of all significant events identified through the forensic examination, from the earliest coordination communications (August 2022) through the last identified use of Lumos materials on NovaSpark's systems (January 2023).
This memorandum is intended solely for the internal use of the Calderwood & Harkness LLP litigation team assigned to the above-captioned matter. It reflects the preliminary analysis and mental impressions of the author as of the date hereof and is subject to revision as additional information becomes available.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Omar Siddiqui, Working Associate
Date: May 5, 2023
Trade Secret Category | Found on Anand Devices | Found on Mallick Devices | Found on Yun Devices | Found on NovaSpark Servers
(1) LumosEdge ML Model Architecture (neural-network topology, hyperparameters, signal-generation engine specifications) | Yes — Hollowell Health IT account; personal laptop | No | No | Yes — in active development environment
(2) Feature-Engineering Libraries (2,847 engineered features in 47 Jupyter notebooks) | No | No | Yes — Larkspur Technologies account; personal laptop | Yes — 39 of 47 notebooks in /ml-models/feature-lib/
(3) DataStream ETL Pipeline Codebase (43 vendor integrations, data-schema definitions) | No | Yes — USB drive WD-4837291; personal laptop | No | Yes — modified copies in /core-pipelines/data-ingest/
(4) Training Dataset (~14.6 TB curated dataset) | Partial references and sample subsets only | No | Partial references embedded in notebooks | Partial subsets found
(5) LumosEdge 3.0 Product Roadmap (37-page PDF, 2023–2025 specifications) | Yes — personal email; personal laptop | No | No | Yes — in /strategy/competitive-intel/

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

INTERNAL MEMORANDUM

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts