1017-00005 · Aurelius Global Media Group · Document Collection & Forensics

chain-of-custody-certification.docx DOCUMENT Funds

20 / 38 ← → ✕

CHAIN OF CUSTODY CERTIFICATION

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL. This certification is prepared by Linden Forensics Group Inc. in its capacity as agent of counsel, Calderwood & Harkness LLP, retained to provide legal services to Aurelius Global Media Group PLC. All work performed is protected by the attorney-client privilege and work-product doctrine. Any unauthorized review, use, disclosure, or distribution of this document is strictly prohibited.

From: Linden Forensics Group Inc. 201 Mission Street, Suite 1400 San Francisco, CA 94105

To: Calderwood & Harkness LLP 1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067

Attention: Devon Archer, Lead Associate, Labor & Employment Practice

Date: May 12, 2023

Re: Forensic Data Collection and Processing — Aurelius Pacific Studios Inc. Workplace Investigation

Calderwood & Harkness Matter No.: 1017-00005

Linden Forensics Project Reference: LFG-2023-0587

Right-click to update Table of Contents

1. Introduction and Purpose

Linden Forensics Group Inc. ("Linden Forensics" or the "Firm") was retained by Calderwood & Harkness LLP ("C&H") pursuant to an engagement letter dated May 8, 2023 (the "Engagement Letter") to perform forensic collection, preservation, and processing of electronically stored information ("ESI") from identified custodians at Aurelius Pacific Studios Inc. ("APS"), a Delaware corporation headquartered at 3200 West Alameda Avenue, Suite 400, Burbank, California 91505. APS is a wholly owned subsidiary of Aurelius Global Media Group PLC, the ultimate parent entity to which C&H provides legal services in connection with the underlying workplace investigation.

Linden Forensics was engaged as an agent of counsel for the express purpose of preserving the attorney-client privilege and attorney work-product protections that attach to the legal services being rendered by C&H in connection with the APS workplace investigation. All forensic collection, processing, and analytical work described herein was performed at the direction of, and under the supervision of, C&H attorneys. No work product, data, or communications generated in connection with this engagement have been disclosed to any third party outside the scope of the attorney-client relationship, except as expressly authorized by C&H.

The purpose of this Chain of Custody Certification (this "Certification") is to certify the integrity, completeness, and defensibility of the forensic collection process conducted by Linden Forensics between May 10, 2023 and May 12, 2023 (the "Collection Period"). This Certification documents the chain of custody for all ESI collected, processed, and transferred during the Collection Period, and is intended to provide a comprehensive, defensible record suitable for use in connection with potential litigation, regulatory proceedings, arbitration, or any other legal proceeding that may arise from or relate to the APS workplace investigation.

All collection activities described in this Certification were conducted in strict accordance with the Forensic Collection Protocol & Custodian List Memorandum provided by C&H, dated May 8, 2023 (the "Forensic Collection Protocol" or the "Protocol"), which governed the scope, parameters, and methodology of the forensic collection. A copy of the Forensic Collection Protocol has been retained in the permanent case file maintained by Linden Forensics for this engagement.

This Certification is issued as of the date set forth above and reflects the status of the collected ESI as of the completion of the collection, processing, and secure transfer to C&H's designated review platform on May 12, 2023.

2. Scope of Collection

2.1 Custodians. C&H identified nine (9) custodians for forensic data collection, as set forth in the Forensic Collection Protocol dated May 8, 2023. The following five (5) custodians are identified by name and title in this Certification:

Four (4) additional custodians (Custodians 6 through 9) are Senior Vice President–level witnesses whose full names, titles, and individual data source specifications are set forth in the detailed custodian identification list maintained by Linden Forensics and appended to this Certification as Exhibit A. The identities of Custodians 6 through 9 have been withheld from the body of this Certification for brevity, at the direction of C&H; however, their names, titles, departmental affiliations, and data source details are fully documented in Exhibit A and in the detailed collection logs maintained as part of the permanent case record.

All nine (9) custodians are current employees or, in the case of Mr. Hale, a current employee on paid administrative leave, of Aurelius Pacific Studios Inc.

2.2 Data Sources

The following categories of data sources were collected for each of the nine (9) identified custodians, as specified in the Forensic Collection Protocol:

(a) Corporate Email (Strathmore Data Systems / Outlook). APS maintains its enterprise email infrastructure on Strathmore Data Systems servers hosted on-premises at APS's corporate data center in Burbank, California. Corporate email accounts for all nine custodians were collected, including mailbox contents (inbox, sent items, drafts, deleted items, archived items, and all user-created folders), calendar entries, contacts, and tasks associated with each custodian's Hollowell Systems profile.

(b) Corporate Meridian Solutions Workspace Messages. APS utilizes a Meridian Solutions Enterprise Grid workspace ("APS-Internal") as a primary internal communications platform. For each custodian, Linden Forensics collected all direct messages (one-on-one and group direct messages) as well as messages posted in relevant Meridian Solutions channels identified in the Forensic Collection Protocol. Collections were performed through the Meridian Solutions Enterprise administrator console with the cooperation of APS IT personnel, using Meridian Solutions's native export functionality supplemented by forensic extraction tools to ensure completeness.

(c) Text Messages / SMS / Westmark Software (Company-Issued Mobile Devices). For each custodian who had been issued a company mobile device, text messages (SMS), multimedia messages (MMS), and Tidewater Industries Ashbury Health IT were collected through forensic imaging of the company-issued device. The collection of mobile device communications was limited to company-issued devices; personal devices were not within the scope of the Forensic Collection Protocol.

(d) Shared Network Drives and Departmental File Shares. APS maintains shared network drives organized by department. For each custodian, Linden Forensics collected files and folders from the shared network drive locations specified in the Forensic Collection Protocol, including departmental file shares, project-specific shared folders, and any custodian-specific personal network directories ("H: drives" or equivalent).

With respect to Custodian 1, Marcus Hale: Mr. Hale's access to company email, Meridian Solutions, and internal systems had been suspended as of May 3, 2023, in connection with his placement on paid administrative leave by APS. The APS Human Resources department, under the direction of Victor Gallegos (Custodian 5), and APS IT department took affirmative steps on May 3, 2023 to preserve Mr. Hale's electronic data by creating system images and securing server backups of his email account, Meridian Solutions messages, and network drive contents. Mr. Hale's company-issued mobile device was collected and secured by APS HR/IT upon commencement of his administrative leave. Linden Forensics performed its forensic collection of Mr. Hale's data from the preserved system images, server backups, and the secured company-issued mobile device, rather than from live, active systems.

2.3 Date Range

The date range for the forensic collection, as specified by C&H in the Forensic Collection Protocol, was January 1, 2019 through May 3, 2023 (inclusive). The end date corresponds to the date on which Marcus Hale was placed on paid administrative leave and his access to APS systems was suspended.

This date range encompasses the full period of Mr. Hale's tenure as President of Aurelius Pacific Studios Inc., which commenced in January 2019, through the suspension of his systems access on May 3, 2023. C&H determined this date range to be the relevant period for purposes of the workplace investigation, and all collection activities were conducted to capture ESI falling within this window.

It should be noted that while the collection itself captured all data within custodian accounts and data sources without date restriction (to ensure forensic completeness), date-range filtering was applied during the post-collection processing phase, as described in Section 4 below, to isolate documents and communications falling within the specified January 1, 2019 through May 3, 2023 date range.

2.4 Search Parameters

C&H provided a detailed set of search-term parameters in the Forensic Collection Protocol dated May 8, 2023. The search terms included keyword searches, Boolean search strings, custodian-specific terms, and name and alias variations for key individuals relevant to the workplace investigation. The specific search terms are documented in the Forensic Collection Protocol, a copy of which is retained in the permanent case file.

Consistent with forensically sound collection practices, search-term and date-range filtering was not applied during the initial acquisition phase. Instead, full forensic collections were performed for each custodian and data source, and search-term and date-range filters were applied during the post-collection processing phase. This approach ensures the preservation of the complete data set in its original form while enabling targeted filtering for attorney review, and provides the flexibility to apply additional or modified search parameters in the future without necessitating a new collection.

3. Collection Methodology

3.1 On-Site and Remote Collection Procedures

The forensic collection was conducted on-site at APS corporate headquarters, located at 3200 West Alameda Avenue, Suite 400, Burbank, California 91505, during the three-day Collection Period of May 10 through May 12, 2023. Linden Forensics deployed a team of four (4) certified forensic examiners to the APS facility, led by the Engagement Manager assigned to this matter. The team included one Senior Forensic Examiner, two Forensic Examiners, and one Processing Analyst. The qualifications and certifications of all personnel are set forth in Section 7 below.

Prior to commencing the on-site collection, Linden Forensics coordinated with the APS IT department, specifically the Director of Information Technology and two senior systems administrators, to arrange access to the following systems and platforms:

(a) The Strathmore Data Systems email servers hosting custodial mailboxes for all nine identified custodians;

(b) The Meridian Solutions Enterprise administrator console for the APS-Internal workspace, which enabled the export and extraction of custodial Brightmoor Data Systems;

(c) The APS mobile device management ("MDM") platform (Ridgeway Software), through which company-issued mobile devices are managed, and from which device inventory and configuration data was obtained to identify and locate the specific mobile devices assigned to each custodian;

(d) The APS shared network drive infrastructure, including departmental file servers and custodian-specific personal network directories; and

(e) The preserved system images and server backups of Marcus Hale's data, which had been created and secured by APS IT on May 3, 2023 upon the commencement of Mr. Hale's administrative leave.

APS IT personnel were present during the collection to provide systems access and technical support as needed. Linden Forensics personnel directed and performed all forensic acquisition activities; APS IT personnel did not perform any forensic collections and did not have access to the collected data or forensic images.

For the collection of data from Marcus Hale's accounts and devices, Linden Forensics performed the forensic collection from the server-side data and preserved system images that had been created and secured by APS HR and IT on May 3, 2023. Mr. Hale's company-issued mobile device (an Ashbury Corporation 14 Pro, APS asset tag No. APS-MOB-2287), which had been collected by APS HR and stored in a secure evidence locker maintained by the APS Human Resources department, was retrieved by Linden Forensics on May 10, 2023 for forensic imaging. The retrieval was documented in the chain of custody log, including the identity of the APS HR representative who released the device and the Linden Forensics examiner who received it.

For mobile device data collection (text messages, SMS, and Ashbury Health IT) from company-issued devices assigned to the remaining custodians, Linden Forensics performed forensic imaging of each custodian's company-issued mobile device using industry-standard mobile forensic acquisition tools. Company-issued mobile devices for Custodians 2 through 9 were collected from the individual custodians during the on-site collection, imaged by Linden Forensics examiners, and returned to the custodians upon completion of imaging. The collection and return of each mobile device was documented in the chain of custody log, including the date and time of collection, the identity of the custodian from whom the device was collected, the date and time the device was returned, and confirmation that a forensically sound image was successfully acquired before the device was returned.

3.2 Forensic Imaging Standards

All forensic data collections were performed using forensically sound, write-blocked imaging technology to ensure that no data was altered, modified, or overwritten during the acquisition process. The following standards and procedures were followed:

(a) Write-blocking. Hardware write-blockers (Westvale Health IT T35689iu Forensic USB 3.0 Bridge and Westvale Health IT T8-R2 Forensic USB Bridge) were employed for all acquisitions from physical storage media, including hard drives, solid-state drives, and mobile device storage. Software-based write-blocking was employed for acquisitions from server-based data sources (email servers, Meridian Solutions exports, and network drive file shares) to prevent any alteration to the source data during the acquisition process.

(b) Bit-for-Bit Forensic Images. Where applicable and technically feasible, bit-for-bit (physical) forensic images were created of the relevant storage media or data containers. This approach captures a complete, exact replica of the source data, including deleted files, unallocated space, file system metadata, and all other forensically relevant artifacts.

(c) Logical Acquisitions. For certain data sources — specifically, email server mailboxes, Meridian Solutions workspace exports, and network drive file shares — logical acquisitions were performed in lieu of physical images, consistent with standard forensic practice for server-based and cloud-based data sources. Logical acquisitions capture the complete content and metadata of the target data containers in a forensically defensible format.

(d) Mobile Device Forensic Imaging. Company-issued mobile devices were forensically imaged using Drayton Technologies (version 7.62) and Ostrander Systems (version 7.62). Full file system extractions were performed where device configuration and security settings permitted; advanced logical extractions were performed in all other cases.

(e) Real-Time Documentation. All forensic acquisition activities were documented in real-time in forensic examiner logs maintained by each examiner during the collection. These logs record the date and time of each action taken, the identity of the examiner performing the action, the specific data source and custodian to which the action relates, the tools and methods employed, and any observations, anomalies, or exceptions encountered. The forensic examiner logs are maintained as part of the permanent case record.

A complete inventory of the forensic collection equipment and software used during the Collection Period, including version numbers and calibration and validation records, is appended to this Certification as Exhibit D.

3.3 Hash Verification

To ensure and certify the integrity of all collected data, SHA-256 cryptographic hash values were computed for all forensic images and data sets at the time of acquisition. The SHA-256 algorithm produces a unique, fixed-length digital fingerprint for each data set; any alteration to the data, no matter how minor, would produce a different hash value, thereby detecting any unauthorized modification.

The following hash verification procedures were implemented:

(a) At the Point of Acquisition. Immediately upon completion of each forensic acquisition, a SHA-256 hash value was computed for the resulting forensic image or data set. This hash value was recorded in the forensic examiner log and in the hash verification log.

(b) Post-Transfer Verification. Upon transfer of the processed and filtered data to C&H's designated secure hosted review platform (described in Section 5 below), SHA-256 hash values were recomputed for all transferred data sets and compared against the original acquisition-time hash values. In every instance, the post-transfer hash values matched the original hash values, confirming that no alterations, additions, or deletions occurred during processing, transfer, or at any point in the chain of custody.

(c) Integrity Confirmation. Based on the hash verification results, Linden Forensics certifies that the data transferred to C&H's review platform is an authentic, unaltered replica of the data as originally collected from the custodial data sources. No evidence of data corruption, tampering, or unauthorized modification was detected at any stage of the collection, processing, or transfer workflow.

The complete SHA-256 hash verification logs, including all computed hash values for each forensic image and transferred data set, are maintained as part of the permanent case record and are appended to this Certification as Exhibit B.

3.4 Defensibility Statement

The forensic collection methodology employed by Linden Forensics in this engagement is designed to comply with generally accepted forensic standards and industry best practices for the collection, preservation, and processing of electronically stored information. Specifically, the methodology adheres to the following legal and technical standards:

(a) The Federal Rules of Civil Procedure, including Rule 34 (governing the production of documents and electronically stored information) and Rule 37(e) (governing the failure to preserve electronically stored information and the imposition of sanctions for spoliation), as well as the Advisory Committee Notes accompanying Rule 37(e), which emphasize the importance of employing reasonable preservation and collection procedures;

(b) The California Code of Civil Procedure, Section 2031.010 et seq., governing inspection, copying, testing, and sampling of documents and electronically stored information in California state court proceedings;

(c) The Sedona Conference Commentary on ESI Evidence and Admissibility, which provides authoritative guidance on the principles governing the admissibility and defensibility of electronically stored information;

(d) The National Institute of Standards and Technology (NIST) Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, and NIST Special Publication 800-101, Guidelines on Mobile Device Forensics;

(e) The Scientific Working Group on Digital Evidence (SWGDE) Best Practices for Computer Forensics and Digital Evidence; and

(f) The International Organization on Computer Evidence (IOCE) principles for the handling and processing of digital evidence.

All collection procedures were designed to ensure the admissibility and defensibility of the collected data in potential litigation, regulatory proceedings, arbitration, or any other legal proceeding. The chain of custody was maintained at all times, and all forensic images and data sets were authenticated through cryptographic hash verification.

4. Processing and De-Duplication

4.1 Volume Metrics — Pre-Processing

Upon completion of the forensic collection for all nine (9) custodians across all identified data sources, the total volume of documents, communications, and files collected was approximately 847,000 items. This pre-processing figure includes all emails, email attachments, Meridian Solutions messages, text messages (SMS/Westmark Software), calendar entries, contacts, and shared network drive files captured during the Collection Period.

The 847,000-item pre-processing total includes duplicates (e.g., the same email appearing in both a sender's and recipient's mailbox), system-generated items (e.g., automated calendar notifications, read receipts, and out-of-office replies), and items falling outside the specified date range of January 1, 2019 through May 3, 2023.

4.2 De-Duplication. Industry-standard de-duplication was performed on the collected data set to eliminate exact duplicate items. De-duplication was performed using hash-based comparison, employing both MD5 and SHA-256 hash algorithms to identify and remove exact duplicates at the global (cross-custodian) level. Items were identified as duplicates where both the MD5 and SHA-256 hash values of the item matched, indicating byte-for-byte identity.

De-duplication was performed across all custodians and data sources in accordance with the Forensic Collection Protocol. The de-duplication process preserved the original custodian attribution and metadata for each item, ensuring that the custodial source of each unique item could be traced and that family groupings (e.g., email and attachments) were maintained.

Following de-duplication, the data set was reduced to approximately 214,000 unique items. This represents the removal of approximately 633,000 duplicate items from the pre-processing total of 847,000 items, a de-duplication rate of approximately 74.7%.

4.3 Search-Term and Date-Range Filtering

Following de-duplication, Linden Forensics applied the search-term parameters and date-range filters specified in C&H's May 8, 2023 Forensic Collection Protocol to the de-duplicated data set of approximately 214,000 unique items.

(a) Date-Range Filtering. Items with document dates, email sent/received dates, message timestamps, or file creation/modification dates falling outside the specified range of January 1, 2019 through May 3, 2023 were excluded from the filtered data set. Items for which no reliable date metadata was available were retained in the filtered set for manual attorney review to ensure that potentially relevant documents were not inadvertently excluded.

(b) Search-Term Filtering. The keyword and Boolean search terms specified in the Forensic Collection Protocol were applied to the date-range-filtered data set. Search-term filtering was applied across all searchable text fields, including email body text, email subject lines, file names, file contents (where text-searchable or OCR-processed), Meridian Solutions message content, and text message content.

After application of both date-range and search-term filters, the resulting data set comprised approximately 38,600 items identified as responsive to the filtering parameters and suitable for attorney review.

The filtered data set of approximately 38,600 items was loaded to C&H's designated secure hosted document review platform for review by C&H's attorney review team. The unfiltered, de-duplicated data set of approximately 214,000 unique items, as well as the original, un-de-duplicated data set of approximately 847,000 items, are preserved in their entirety in Linden Forensics' secure evidence storage facility and remain available for additional processing, filtering, or re-loading as directed by C&H.

5. Secure Transfer and Storage

The processed and filtered data set of approximately 38,600 items was transferred to C&H's designated secure hosted document review platform on May 12, 2023. The transfer was conducted via encrypted file transfer using AES-256 encryption, ensuring the security and confidentiality of the data both in transit and at rest. The following security measures were implemented in connection with the transfer:

(a) Encryption in Transit. All data was encrypted using AES-256 encryption during electronic transfer from Linden Forensics' processing environment to C&H's hosted review platform. Transfer was conducted over a secure, encrypted connection (TLS 1.3) to prevent interception or unauthorized access during transmission.

(b) Encryption at Rest. The data, once loaded to C&H's hosted review platform, is encrypted at rest using AES-256 encryption in accordance with the platform provider's security policies, which have been reviewed and approved by both Linden Forensics and C&H.

(c) Post-Transfer Hash Verification. Following the completion of the data transfer, SHA-256 hash values were recomputed for all transferred data sets and compared against the pre-transfer hash values. All post-transfer hash values matched their corresponding pre-transfer values, confirming the complete and unaltered transfer of all 38,600 filtered items to the review platform. No data corruption, loss, or modification was detected.

(d) Transfer Log. A detailed transfer log documenting the date, time, method, and participants involved in the data transfer is maintained as part of the permanent case record and is included in the chain of custody log appended as Exhibit C.

Original forensic images and collection media, including all forensic image files, forensic examiner logs, hash verification logs, processing work files, and related documentation, are stored in Linden Forensics' secure evidence storage facility located at 201 Mission Street, Suite 1400, San Francisco, California 94105. The evidence storage facility maintains the following security controls:

(a) Restricted physical access controlled by badge entry and biometric authentication, limited to authorized Linden Forensics personnel assigned to this engagement;

(b) 24/7 video surveillance monitoring of the evidence storage area;

(d) Logical access controls, including multi-factor authentication and role-based access restrictions, for all digital evidence stored on Linden Forensics' secure servers;

(e) All evidence is stored in accordance with Linden Forensics' evidence retention and chain of custody policies, which require documented chain of custody for all evidence from the point of receipt through final disposition.

Access to the original forensic images and collected data is restricted exclusively to authorized Linden Forensics personnel assigned to this engagement. No data or forensic images have been released to any party other than C&H, and no release of data to any third party will be made without the prior written authorization of C&H.

6. Chain of Custody Log Summary

A detailed chain of custody log has been maintained for all physical and digital evidence from the initial point of collection through transfer of the processed data to C&H's review platform. The chain of custody log constitutes a contemporaneous, written record of every custody event affecting the collected evidence, and is designed to establish an unbroken chain of custody sufficient to support the admissibility and authentication of the collected ESI in any legal proceeding.

Each entry in the chain of custody log includes the following information:

• Date and time of the custody event (recorded in local Pacific Daylight Time);

• Description of the custody event (e.g., collection, imaging, transfer, storage, processing, data load);

• Identity of the individual transferring custody of the evidence;

• Identity of the individual receiving custody of the evidence;

• Description of the evidence (data source, custodian, media type, file name or identifier);

• SHA-256 hash value(s) associated with the evidence at the time of the custody event;

• Storage location of the evidence following the custody event; and

• Any observations, anomalies, or exceptions noted during the custody event.

The full, detailed chain of custody log is appended to this Certification as Exhibit C. The following table provides a summary of the key custody events during the Collection Period:

The above summary reflects the key milestones of the collection and transfer process. Detailed, granular custody entries (including individual custodian-level and device-level entries) are documented in the full chain of custody log in Exhibit C.

7. Personnel Involved

The following Linden Forensics personnel performed or supervised the forensic collection, processing, and data transfer activities described in this Certification:

All personnel identified above hold current, active certifications in the relevant fields of digital forensics, mobile device forensics, and/or electronic discovery, as indicated. Certification credentials are maintained in personnel files at Linden Forensics and are available for verification upon request.

All Linden Forensics personnel who participated in this engagement are bound by the confidentiality obligations set forth in the May 8, 2023 Engagement Letter between Linden Forensics and C&H. Additionally, all personnel have executed Linden Forensics' standard internal confidentiality and non-disclosure agreements, which impose obligations of confidentiality with respect to all client data, case information, and work product.

No Linden Forensics personnel other than those identified above had access to the collected data, forensic images, or any information relating to this engagement.

8. Exceptions and Observations

Linden Forensics is required, under its standard operating procedures and the terms of the Engagement Letter, to document and disclose any exceptions, anomalies, or deviations from the Forensic Collection Protocol encountered during the collection, processing, or transfer of ESI. The following exceptions and observations are noted:

No Material Exceptions. Linden Forensics confirms that no material exceptions were encountered during the forensic collection. All nine (9) custodians' data was successfully collected from all identified data sources (corporate email, Meridian Solutions workspace messages, text messages/SMS/Westmark Software from company-issued mobile devices, and shared network drives/departmental file shares). No data sources identified in the Forensic Collection Protocol were inaccessible, corrupted, or otherwise unavailable for collection.

Marcus Hale Personal Mobile Device. It is noted that Marcus Hale's personal mobile device was not within the scope of the Forensic Collection Protocol and was not collected or imaged by Linden Forensics. The collection of Mr. Hale's mobile communications was limited to his company-issued mobile device (Ashbury Corporation 14 Pro, APS asset tag No. APS-MOB-2287). Text messages, SMS, and Ashbury Health IT were collected from the company-issued device. C&H has advised that, to the extent carrier-level call and message records for Mr. Hale's company-issued device number are available, such records have been or will be obtained separately through a carrier records request and are not within the scope of this Certification.

Meridian Solutions Data Export Completeness. APS maintains a Meridian Solutions Enterprise Grid workspace with a data retention policy that retains all messages. No Meridian Solutions messages within the specified date range were unavailable due to deletion or retention policy limitations. The Meridian Solutions data export was confirmed to be complete for all nine custodians.

Mobile Device Availability. All company-issued mobile devices for the nine custodians were available for forensic imaging during the Collection Period. No device was reported lost, damaged, or otherwise unavailable. All devices were returned to custodians (Custodians 2 through 9) upon completion of imaging. Mr. Hale's company-issued device is retained in Linden Forensics' custody at C&H's direction.

Encrypted Containers. No encrypted containers, password-protected files, or other access-restricted data objects that could not be accessed during processing were identified in the collected data set. All collected data was fully accessible and processable.

In summary, the forensic collection proceeded in accordance with the Forensic Collection Protocol without material deviation, and Linden Forensics has no exceptions, anomalies, or concerns to report regarding the integrity, completeness, or defensibility of the collection.

9. Certification Statement

Linden Forensics Group Inc., by and through the undersigned Engagement Manager, hereby formally certifies as follows:

1. The forensic collection described in this Certification was conducted in strict accordance with the Forensic Collection Protocol provided by Calderwood & Harkness LLP, dated May 8, 2023, including the scope, custodian identification, data source specifications, date range, and search-term parameters set forth therein.

2. All electronically stored information was collected using forensically sound, defensible methodology, including the use of write-blocked imaging technology, bit-for-bit forensic imaging (where applicable), logical acquisitions, and industry-standard mobile device forensic extraction tools. The collection methodology adheres to generally accepted forensic standards and best practices, as described in Section 3.4 of this Certification.

3. SHA-256 cryptographic hash values were computed for all collected data at the point of acquisition and were verified post-transfer to Calderwood & Harkness LLP's designated secure hosted review platform. In all instances, the post-transfer hash values matched the original acquisition-time hash values, confirming the integrity and authenticity of all collected data. No alterations, additions, deletions, or unauthorized modifications occurred at any stage of the collection, processing, or transfer workflow.

4. The chain of custody for all physical and digital evidence was maintained at all times, from the initial point of collection at APS headquarters on May 10, 2023 through the secure transfer of the filtered data set to Calderwood & Harkness LLP's review platform on May 12, 2023, and continuing through the ongoing secure storage of original forensic images at Linden Forensics' evidence storage facility. The chain of custody is documented in contemporaneous, written logs appended to this Certification as Exhibit C.

5. A total of approximately 847,000 documents, communications, and files were collected across all nine (9) identified custodians and all identified data sources. Following industry-standard de-duplication, the data set was reduced to approximately 214,000 unique items. After application of the search-term and date-range filters specified in the Forensic Collection Protocol, approximately 38,600 items were identified for attorney review and loaded to Calderwood & Harkness LLP's secure review platform.

6. All work described in this Certification was performed by Linden Forensics Group Inc. in its capacity as agent of counsel, at the direction of and under the supervision of Calderwood & Harkness LLP, in connection with privileged legal services rendered to Aurelius Global Media Group PLC. All data, work product, forensic images, logs, and documentation generated in connection with this engagement are protected by the attorney-client privilege and attorney work-product doctrine.

This Certification is made based on the personal knowledge and professional judgment of the undersigned and the Linden Forensics team members identified in Section 7 above. The undersigned affirms that the foregoing statements are true and accurate to the best of his knowledge, information, and belief, formed after reasonable inquiry.

10. Signature block

LINDEN FORENSICS GROUP INC.

By: ________

Name: Nathaniel R. Park

Title: Engagement Manager

Date: May 12, 2023

Linden Forensics Group Inc. 201 Mission Street, Suite 1400 San Francisco, CA 94105 Telephone: (415) 555-0172

Email: npark@lindenforensics.com

Exhibits

The following exhibits are referenced in this Certification and are appended hereto. Exhibits A through D are incorporated by reference and form an integral part of this Chain of Custody Certification.

Exhibit A — Custodian Identification List

A complete list of all nine (9) custodians identified for forensic data collection, including full legal names, titles, departmental affiliations within Aurelius Pacific Studios Inc., and a detailed specification of the data sources collected for each custodian. Exhibit A also includes the unique custodian identification numbers assigned by Linden Forensics for tracking and documentation purposes.

[Exhibit A is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]

Exhibit B — Hash Verification Logs

Complete SHA-256 cryptographic hash verification logs for all forensic images and transferred data sets, including:

• Hash values computed at the time of forensic acquisition;

• Hash values recomputed post-processing;

• Hash values recomputed post-transfer to Calderwood & Harkness LLP's review platform; and

• Verification results confirming the match of all hash values at each stage.

[Exhibit B is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]

Exhibit C — Detailed Chain of Custody Log

The complete, contemporaneous chain of custody log documenting every custody event for all physical and digital evidence collected during this engagement. The log includes granular date/time entries, identity of all transferring and receiving personnel, descriptions of evidence items, associated hash values, storage locations, and any observations or exceptions noted during each custody event.

[Exhibit C is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]

Exhibit D — Collection Equipment and Software Inventory

A comprehensive inventory of all forensic collection equipment and software tools used during the Collection Period, including:

• Hardware write-blockers (manufacturer, model, serial number);

• Forensic imaging software (name, version number, license information);

• Mobile device forensic tools (name, version number, license information);

• Processing and de-duplication software (name, version number);

• Encryption tools (name, version number); and

• Calibration and validation records for all equipment and software, confirming that all tools were operating within validated parameters during the Collection Period.

[Exhibit D is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]

— End of Certification —

Custodian No.	Full Name	Title	Entity
1	Marcus Hale	President	Aurelius Pacific Studios Inc.
2	Jenna Morales	Vice President of Development	Aurelius Pacific Studios Inc.
3	Claire Ngo	Senior Director of Talent Relations	Aurelius Pacific Studios Inc.
4	Darren Whitfield	Senior Vice President of Physical Production	Aurelius Pacific Studios Inc.
5	Victor Gallegos	Vice President of Human Resources	Aurelius Pacific Studios Inc.
Date	Time (PDT)	Custody Event	Description
May 10, 2023	08:00 AM	Collection Commenced	Linden Forensics team arrived on-site at APS headquarters. Credentials and systems access confirmed with APS IT. Collection of corporate email (Strathmore Data Systems) and Meridian Solutions workspace data commenced for Custodians 1 through 5. Hale's company-issued mobile device received from APS HR (asset tag APS-MOB-2287).
May 10, 2023	06:45 PM	Daily Collection Checkpoint	Email and Meridian Solutions data collection completed for Custodians 1 through 3. Forensic imaging of Hale's mobile device commenced. All collected data secured in Linden Forensics' on-site evidence storage (locked, access-controlled workroom at APS).
May 11, 2023	07:30 AM	Collection Continued	Email and Meridian Solutions data collection commenced for Custodians 6 through 9. Completion of email and Meridian Solutions data collection for Custodians 4 and 5. Mobile device forensic imaging commenced for Custodians 2 through 5.
May 11, 2023	10:00 AM	Shared Drive Collection	Collection of shared network drive and departmental file share data commenced for all nine (9) identified custodians.
May 11, 2023	07:15 PM	Daily Collection Checkpoint	Email and Meridian Solutions data collection completed for Custodians 6 through 9. Mobile device imaging completed for Custodians 2 through 7. Shared drive collection ongoing. All collected data secured in on-site evidence storage.
May 12, 2023	07:30 AM	Collection Continued	Mobile device imaging completed for Custodians 8 and 9. Shared drive collection finalized. All company-issued mobile devices returned to custodians (Custodians 2–9). Hale's device retained in Linden Forensics custody per C&H direction.
May 12, 2023	11:00 AM	Collection Completed	All forensic data collection activities completed. SHA-256 hash values computed for all forensic images.
May 12, 2023	12:30 PM	Processing & De-Duplication	Processing, de-duplication, and search-term/date-range filtering finalized. Filtered data set of approximately 38,600 items prepared for transfer.
May 12, 2023	03:00 PM	Data Transferred	Filtered data set transferred via AES-256 encrypted file transfer to C&H's designated secure hosted review platform. Post-transfer SHA-256 hash verification completed; all hash values confirmed to match.
May 12, 2023	04:30 PM	Evidence Secured	All original forensic images, collection media, forensic examiner logs, and associated documentation packaged for secure transport to Linden Forensics' evidence storage facility in San Francisco.
Name	Role	Certifications
Nathaniel R. Park	Engagement Manager	Certified Computer Examiner (CCE); Penrose Technologies Certified Examiner (EnCE); Certified Forensic Computer Examiner (CFCE)
Lisa M. Okonkwo	Senior Forensic Examiner	Penrose Technologies Certified Examiner (EnCE); Westmark Data Systems Certified Examiner (ACE); Sundial Services Inc. Certified Mobile Examiner (CCME)
Ryan T. Gallagher	Forensic Examiner	Penrose Technologies Certified Examiner (EnCE); Sundial Services Inc. Certified Physical Analyst (CCPA)
Priya S. Chandra	Forensic Examiner	Westmark Data Systems Certified Examiner (ACE); Sundial Services Inc. Certified Mobile Examiner (CCME); Certified Information Systems Security Professional (CISSP)
Daniel K. Wu	Processing Analyst	Relativity Certified Administrator (RCA); Severin Software Certified User; Certified eDiscovery Specialist (CEDS)

CHAIN OF CUSTODY CERTIFICATION
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL. This certification is prepared by Linden Forensics Group Inc. in its capacity as agent of counsel, Calderwood & Harkness LLP, retained to provide legal services to Aurelius Global Media Group PLC. All work performed is protected by the attorney-client privilege and work-product doctrine. Any unauthorized review, use, disclosure, or distribution of this document is strictly prohibited.
From: Linden Forensics Group Inc. 201 Mission Street, Suite 1400 San Francisco, CA 94105
To: Calderwood & Harkness LLP 1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067
Attention: Devon Archer, Lead Associate, Labor & Employment Practice
Date: May 12, 2023
Re: Forensic Data Collection and Processing — Aurelius Pacific Studios Inc. Workplace Investigation
Calderwood & Harkness Matter No.: 1017-00005
Linden Forensics Project Reference: LFG-2023-0587
Right-click to update Table of Contents
1. Introduction and Purpose
Linden Forensics Group Inc. ("Linden Forensics" or the "Firm") was retained by Calderwood & Harkness LLP ("C&H") pursuant to an engagement letter dated May 8, 2023 (the "Engagement Letter") to perform forensic collection, preservation, and processing of electronically stored information ("ESI") from identified custodians at Aurelius Pacific Studios Inc. ("APS"), a Delaware corporation headquartered at 3200 West Alameda Avenue, Suite 400, Burbank, California 91505. APS is a wholly owned subsidiary of Aurelius Global Media Group PLC, the ultimate parent entity to which C&H provides legal services in connection with the underlying workplace investigation.
Linden Forensics was engaged as an agent of counsel for the express purpose of preserving the attorney-client privilege and attorney work-product protections that attach to the legal services being rendered by C&H in connection with the APS workplace investigation. All forensic collection, processing, and analytical work described herein was performed at the direction of, and under the supervision of, C&H attorneys. No work product, data, or communications generated in connection with this engagement have been disclosed to any third party outside the scope of the attorney-client relationship, except as expressly authorized by C&H.
The purpose of this Chain of Custody Certification (this "Certification") is to certify the integrity, completeness, and defensibility of the forensic collection process conducted by Linden Forensics between May 10, 2023 and May 12, 2023 (the "Collection Period"). This Certification documents the chain of custody for all ESI collected, processed, and transferred during the Collection Period, and is intended to provide a comprehensive, defensible record suitable for use in connection with potential litigation, regulatory proceedings, arbitration, or any other legal proceeding that may arise from or relate to the APS workplace investigation.
All collection activities described in this Certification were conducted in strict accordance with the Forensic Collection Protocol & Custodian List Memorandum provided by C&H, dated May 8, 2023 (the "Forensic Collection Protocol" or the "Protocol"), which governed the scope, parameters, and methodology of the forensic collection. A copy of the Forensic Collection Protocol has been retained in the permanent case file maintained by Linden Forensics for this engagement.
This Certification is issued as of the date set forth above and reflects the status of the collected ESI as of the completion of the collection, processing, and secure transfer to C&H's designated review platform on May 12, 2023.
2. Scope of Collection
2.1 Custodians.  C&H identified nine (9) custodians for forensic data collection, as set forth in the Forensic Collection Protocol dated May 8, 2023. The following five (5) custodians are identified by name and title in this Certification:
Four (4) additional custodians (Custodians 6 through 9) are Senior Vice President–level witnesses whose full names, titles, and individual data source specifications are set forth in the detailed custodian identification list maintained by Linden Forensics and appended to this Certification as Exhibit A. The identities of Custodians 6 through 9 have been withheld from the body of this Certification for brevity, at the direction of C&H; however, their names, titles, departmental affiliations, and data source details are fully documented in Exhibit A and in the detailed collection logs maintained as part of the permanent case record.
All nine (9) custodians are current employees or, in the case of Mr. Hale, a current employee on paid administrative leave, of Aurelius Pacific Studios Inc.
2.2 Data Sources
The following categories of data sources were collected for each of the nine (9) identified custodians, as specified in the Forensic Collection Protocol:
(a) Corporate Email (Strathmore Data Systems / Outlook). APS maintains its enterprise email infrastructure on Strathmore Data Systems servers hosted on-premises at APS's corporate data center in Burbank, California. Corporate email accounts for all nine custodians were collected, including mailbox contents (inbox, sent items, drafts, deleted items, archived items, and all user-created folders), calendar entries, contacts, and tasks associated with each custodian's Hollowell Systems profile.
(b) Corporate Meridian Solutions Workspace Messages. APS utilizes a Meridian Solutions Enterprise Grid workspace ("APS-Internal") as a primary internal communications platform. For each custodian, Linden Forensics collected all direct messages (one-on-one and group direct messages) as well as messages posted in relevant Meridian Solutions channels identified in the Forensic Collection Protocol. Collections were performed through the Meridian Solutions Enterprise administrator console with the cooperation of APS IT personnel, using Meridian Solutions's native export functionality supplemented by forensic extraction tools to ensure completeness.
(c) Text Messages / SMS / Westmark Software (Company-Issued Mobile Devices). For each custodian who had been issued a company mobile device, text messages (SMS), multimedia messages (MMS), and Tidewater Industries Ashbury Health IT were collected through forensic imaging of the company-issued device. The collection of mobile device communications was limited to company-issued devices; personal devices were not within the scope of the Forensic Collection Protocol.
(d) Shared Network Drives and Departmental File Shares. APS maintains shared network drives organized by department. For each custodian, Linden Forensics collected files and folders from the shared network drive locations specified in the Forensic Collection Protocol, including departmental file shares, project-specific shared folders, and any custodian-specific personal network directories ("H: drives" or equivalent).
With respect to Custodian 1, Marcus Hale: Mr. Hale's access to company email, Meridian Solutions, and internal systems had been suspended as of May 3, 2023, in connection with his placement on paid administrative leave by APS. The APS Human Resources department, under the direction of Victor Gallegos (Custodian 5), and APS IT department took affirmative steps on May 3, 2023 to preserve Mr. Hale's electronic data by creating system images and securing server backups of his email account, Meridian Solutions messages, and network drive contents. Mr. Hale's company-issued mobile device was collected and secured by APS HR/IT upon commencement of his administrative leave. Linden Forensics performed its forensic collection of Mr. Hale's data from the preserved system images, server backups, and the secured company-issued mobile device, rather than from live, active systems.
2.3 Date Range
The date range for the forensic collection, as specified by C&H in the Forensic Collection Protocol, was January 1, 2019 through May 3, 2023 (inclusive). The end date corresponds to the date on which Marcus Hale was placed on paid administrative leave and his access to APS systems was suspended.
This date range encompasses the full period of Mr. Hale's tenure as President of Aurelius Pacific Studios Inc., which commenced in January 2019, through the suspension of his systems access on May 3, 2023. C&H determined this date range to be the relevant period for purposes of the workplace investigation, and all collection activities were conducted to capture ESI falling within this window.
It should be noted that while the collection itself captured all data within custodian accounts and data sources without date restriction (to ensure forensic completeness), date-range filtering was applied during the post-collection processing phase, as described in Section 4 below, to isolate documents and communications falling within the specified January 1, 2019 through May 3, 2023 date range.
2.4 Search Parameters
C&H provided a detailed set of search-term parameters in the Forensic Collection Protocol dated May 8, 2023. The search terms included keyword searches, Boolean search strings, custodian-specific terms, and name and alias variations for key individuals relevant to the workplace investigation. The specific search terms are documented in the Forensic Collection Protocol, a copy of which is retained in the permanent case file.
Consistent with forensically sound collection practices, search-term and date-range filtering was not applied during the initial acquisition phase. Instead, full forensic collections were performed for each custodian and data source, and search-term and date-range filters were applied during the post-collection processing phase. This approach ensures the preservation of the complete data set in its original form while enabling targeted filtering for attorney review, and provides the flexibility to apply additional or modified search parameters in the future without necessitating a new collection.
3. Collection Methodology
3.1 On-Site and Remote Collection Procedures
The forensic collection was conducted on-site at APS corporate headquarters, located at 3200 West Alameda Avenue, Suite 400, Burbank, California 91505, during the three-day Collection Period of May 10 through May 12, 2023. Linden Forensics deployed a team of four (4) certified forensic examiners to the APS facility, led by the Engagement Manager assigned to this matter. The team included one Senior Forensic Examiner, two Forensic Examiners, and one Processing Analyst. The qualifications and certifications of all personnel are set forth in Section 7 below.
Prior to commencing the on-site collection, Linden Forensics coordinated with the APS IT department, specifically the Director of Information Technology and two senior systems administrators, to arrange access to the following systems and platforms:
(a) The Strathmore Data Systems email servers hosting custodial mailboxes for all nine identified custodians;
(b) The Meridian Solutions Enterprise administrator console for the APS-Internal workspace, which enabled the export and extraction of custodial Brightmoor Data Systems;
(c) The APS mobile device management ("MDM") platform (Ridgeway Software), through which company-issued mobile devices are managed, and from which device inventory and configuration data was obtained to identify and locate the specific mobile devices assigned to each custodian;
(d) The APS shared network drive infrastructure, including departmental file servers and custodian-specific personal network directories; and
(e) The preserved system images and server backups of Marcus Hale's data, which had been created and secured by APS IT on May 3, 2023 upon the commencement of Mr. Hale's administrative leave.
APS IT personnel were present during the collection to provide systems access and technical support as needed. Linden Forensics personnel directed and performed all forensic acquisition activities; APS IT personnel did not perform any forensic collections and did not have access to the collected data or forensic images.
For the collection of data from Marcus Hale's accounts and devices, Linden Forensics performed the forensic collection from the server-side data and preserved system images that had been created and secured by APS HR and IT on May 3, 2023. Mr. Hale's company-issued mobile device (an Ashbury Corporation 14 Pro, APS asset tag No. APS-MOB-2287), which had been collected by APS HR and stored in a secure evidence locker maintained by the APS Human Resources department, was retrieved by Linden Forensics on May 10, 2023 for forensic imaging. The retrieval was documented in the chain of custody log, including the identity of the APS HR representative who released the device and the Linden Forensics examiner who received it.
For mobile device data collection (text messages, SMS, and Ashbury Health IT) from company-issued devices assigned to the remaining custodians, Linden Forensics performed forensic imaging of each custodian's company-issued mobile device using industry-standard mobile forensic acquisition tools. Company-issued mobile devices for Custodians 2 through 9 were collected from the individual custodians during the on-site collection, imaged by Linden Forensics examiners, and returned to the custodians upon completion of imaging. The collection and return of each mobile device was documented in the chain of custody log, including the date and time of collection, the identity of the custodian from whom the device was collected, the date and time the device was returned, and confirmation that a forensically sound image was successfully acquired before the device was returned.
3.2 Forensic Imaging Standards
All forensic data collections were performed using forensically sound, write-blocked imaging technology to ensure that no data was altered, modified, or overwritten during the acquisition process. The following standards and procedures were followed:
(a) Write-blocking. Hardware write-blockers (Westvale Health IT T35689iu Forensic USB 3.0 Bridge and Westvale Health IT T8-R2 Forensic USB Bridge) were employed for all acquisitions from physical storage media, including hard drives, solid-state drives, and mobile device storage. Software-based write-blocking was employed for acquisitions from server-based data sources (email servers, Meridian Solutions exports, and network drive file shares) to prevent any alteration to the source data during the acquisition process.
(b) Bit-for-Bit Forensic Images. Where applicable and technically feasible, bit-for-bit (physical) forensic images were created of the relevant storage media or data containers. This approach captures a complete, exact replica of the source data, including deleted files, unallocated space, file system metadata, and all other forensically relevant artifacts.
(c) Logical Acquisitions. For certain data sources — specifically, email server mailboxes, Meridian Solutions workspace exports, and network drive file shares — logical acquisitions were performed in lieu of physical images, consistent with standard forensic practice for server-based and cloud-based data sources. Logical acquisitions capture the complete content and metadata of the target data containers in a forensically defensible format.
(d) Mobile Device Forensic Imaging. Company-issued mobile devices were forensically imaged using Drayton Technologies (version 7.62) and Ostrander Systems (version 7.62). Full file system extractions were performed where device configuration and security settings permitted; advanced logical extractions were performed in all other cases.
(e) Real-Time Documentation. All forensic acquisition activities were documented in real-time in forensic examiner logs maintained by each examiner during the collection. These logs record the date and time of each action taken, the identity of the examiner performing the action, the specific data source and custodian to which the action relates, the tools and methods employed, and any observations, anomalies, or exceptions encountered. The forensic examiner logs are maintained as part of the permanent case record.
A complete inventory of the forensic collection equipment and software used during the Collection Period, including version numbers and calibration and validation records, is appended to this Certification as Exhibit D.
3.3 Hash Verification
To ensure and certify the integrity of all collected data, SHA-256 cryptographic hash values were computed for all forensic images and data sets at the time of acquisition. The SHA-256 algorithm produces a unique, fixed-length digital fingerprint for each data set; any alteration to the data, no matter how minor, would produce a different hash value, thereby detecting any unauthorized modification.
The following hash verification procedures were implemented:
(a) At the Point of Acquisition. Immediately upon completion of each forensic acquisition, a SHA-256 hash value was computed for the resulting forensic image or data set. This hash value was recorded in the forensic examiner log and in the hash verification log.
(b) Post-Transfer Verification. Upon transfer of the processed and filtered data to C&H's designated secure hosted review platform (described in Section 5 below), SHA-256 hash values were recomputed for all transferred data sets and compared against the original acquisition-time hash values. In every instance, the post-transfer hash values matched the original hash values, confirming that no alterations, additions, or deletions occurred during processing, transfer, or at any point in the chain of custody.
(c) Integrity Confirmation. Based on the hash verification results, Linden Forensics certifies that the data transferred to C&H's review platform is an authentic, unaltered replica of the data as originally collected from the custodial data sources. No evidence of data corruption, tampering, or unauthorized modification was detected at any stage of the collection, processing, or transfer workflow.
The complete SHA-256 hash verification logs, including all computed hash values for each forensic image and transferred data set, are maintained as part of the permanent case record and are appended to this Certification as Exhibit B.
3.4 Defensibility Statement
The forensic collection methodology employed by Linden Forensics in this engagement is designed to comply with generally accepted forensic standards and industry best practices for the collection, preservation, and processing of electronically stored information. Specifically, the methodology adheres to the following legal and technical standards:
(a) The Federal Rules of Civil Procedure, including Rule 34 (governing the production of documents and electronically stored information) and Rule 37(e) (governing the failure to preserve electronically stored information and the imposition of sanctions for spoliation), as well as the Advisory Committee Notes accompanying Rule 37(e), which emphasize the importance of employing reasonable preservation and collection procedures;
(b) The California Code of Civil Procedure, Section 2031.010 et seq., governing inspection, copying, testing, and sampling of documents and electronically stored information in California state court proceedings;
(c) The Sedona Conference Commentary on ESI Evidence and Admissibility, which provides authoritative guidance on the principles governing the admissibility and defensibility of electronically stored information;
(d) The National Institute of Standards and Technology (NIST) Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, and NIST Special Publication 800-101, Guidelines on Mobile Device Forensics;
(e) The Scientific Working Group on Digital Evidence (SWGDE) Best Practices for Computer Forensics and Digital Evidence; and
(f) The International Organization on Computer Evidence (IOCE) principles for the handling and processing of digital evidence.
All collection procedures were designed to ensure the admissibility and defensibility of the collected data in potential litigation, regulatory proceedings, arbitration, or any other legal proceeding. The chain of custody was maintained at all times, and all forensic images and data sets were authenticated through cryptographic hash verification.
4. Processing and De-Duplication
4.1 Volume Metrics — Pre-Processing
Upon completion of the forensic collection for all nine (9) custodians across all identified data sources, the total volume of documents, communications, and files collected was approximately 847,000 items. This pre-processing figure includes all emails, email attachments, Meridian Solutions messages, text messages (SMS/Westmark Software), calendar entries, contacts, and shared network drive files captured during the Collection Period.
The 847,000-item pre-processing total includes duplicates (e.g., the same email appearing in both a sender's and recipient's mailbox), system-generated items (e.g., automated calendar notifications, read receipts, and out-of-office replies), and items falling outside the specified date range of January 1, 2019 through May 3, 2023.
4.2 De-Duplication.  Industry-standard de-duplication was performed on the collected data set to eliminate exact duplicate items. De-duplication was performed using hash-based comparison, employing both MD5 and SHA-256 hash algorithms to identify and remove exact duplicates at the global (cross-custodian) level. Items were identified as duplicates where both the MD5 and SHA-256 hash values of the item matched, indicating byte-for-byte identity.
De-duplication was performed across all custodians and data sources in accordance with the Forensic Collection Protocol. The de-duplication process preserved the original custodian attribution and metadata for each item, ensuring that the custodial source of each unique item could be traced and that family groupings (e.g., email and attachments) were maintained.
Following de-duplication, the data set was reduced to approximately 214,000 unique items. This represents the removal of approximately 633,000 duplicate items from the pre-processing total of 847,000 items, a de-duplication rate of approximately 74.7%.
4.3 Search-Term and Date-Range Filtering
Following de-duplication, Linden Forensics applied the search-term parameters and date-range filters specified in C&H's May 8, 2023 Forensic Collection Protocol to the de-duplicated data set of approximately 214,000 unique items.
(a) Date-Range Filtering. Items with document dates, email sent/received dates, message timestamps, or file creation/modification dates falling outside the specified range of January 1, 2019 through May 3, 2023 were excluded from the filtered data set. Items for which no reliable date metadata was available were retained in the filtered set for manual attorney review to ensure that potentially relevant documents were not inadvertently excluded.
(b) Search-Term Filtering. The keyword and Boolean search terms specified in the Forensic Collection Protocol were applied to the date-range-filtered data set. Search-term filtering was applied across all searchable text fields, including email body text, email subject lines, file names, file contents (where text-searchable or OCR-processed), Meridian Solutions message content, and text message content.
After application of both date-range and search-term filters, the resulting data set comprised approximately 38,600 items identified as responsive to the filtering parameters and suitable for attorney review.
The filtered data set of approximately 38,600 items was loaded to C&H's designated secure hosted document review platform for review by C&H's attorney review team. The unfiltered, de-duplicated data set of approximately 214,000 unique items, as well as the original, un-de-duplicated data set of approximately 847,000 items, are preserved in their entirety in Linden Forensics' secure evidence storage facility and remain available for additional processing, filtering, or re-loading as directed by C&H.
5. Secure Transfer and Storage
The processed and filtered data set of approximately 38,600 items was transferred to C&H's designated secure hosted document review platform on May 12, 2023. The transfer was conducted via encrypted file transfer using AES-256 encryption, ensuring the security and confidentiality of the data both in transit and at rest. The following security measures were implemented in connection with the transfer:
(a) Encryption in Transit. All data was encrypted using AES-256 encryption during electronic transfer from Linden Forensics' processing environment to C&H's hosted review platform. Transfer was conducted over a secure, encrypted connection (TLS 1.3) to prevent interception or unauthorized access during transmission.
(b) Encryption at Rest. The data, once loaded to C&H's hosted review platform, is encrypted at rest using AES-256 encryption in accordance with the platform provider's security policies, which have been reviewed and approved by both Linden Forensics and C&H.
(c) Post-Transfer Hash Verification. Following the completion of the data transfer, SHA-256 hash values were recomputed for all transferred data sets and compared against the pre-transfer hash values. All post-transfer hash values matched their corresponding pre-transfer values, confirming the complete and unaltered transfer of all 38,600 filtered items to the review platform. No data corruption, loss, or modification was detected.
(d) Transfer Log. A detailed transfer log documenting the date, time, method, and participants involved in the data transfer is maintained as part of the permanent case record and is included in the chain of custody log appended as Exhibit C.
Original forensic images and collection media, including all forensic image files, forensic examiner logs, hash verification logs, processing work files, and related documentation, are stored in Linden Forensics' secure evidence storage facility located at 201 Mission Street, Suite 1400, San Francisco, California 94105. The evidence storage facility maintains the following security controls:
(a) Restricted physical access controlled by badge entry and biometric authentication, limited to authorized Linden Forensics personnel assigned to this engagement;
(b) 24/7 video surveillance monitoring of the evidence storage area;
(c) Environmental controls (temperature and humidity regulation) to protect the integrity of physical storage media;
(d) Logical access controls, including multi-factor authentication and role-based access restrictions, for all digital evidence stored on Linden Forensics' secure servers;
(e) All evidence is stored in accordance with Linden Forensics' evidence retention and chain of custody policies, which require documented chain of custody for all evidence from the point of receipt through final disposition.
Access to the original forensic images and collected data is restricted exclusively to authorized Linden Forensics personnel assigned to this engagement. No data or forensic images have been released to any party other than C&H, and no release of data to any third party will be made without the prior written authorization of C&H.
6. Chain of Custody Log Summary
A detailed chain of custody log has been maintained for all physical and digital evidence from the initial point of collection through transfer of the processed data to C&H's review platform. The chain of custody log constitutes a contemporaneous, written record of every custody event affecting the collected evidence, and is designed to establish an unbroken chain of custody sufficient to support the admissibility and authentication of the collected ESI in any legal proceeding.
Each entry in the chain of custody log includes the following information:
•  Date and time of the custody event (recorded in local Pacific Daylight Time);
•  Description of the custody event (e.g., collection, imaging, transfer, storage, processing, data load);
•  Identity of the individual transferring custody of the evidence;
•  Identity of the individual receiving custody of the evidence;
•  Description of the evidence (data source, custodian, media type, file name or identifier);
•  SHA-256 hash value(s) associated with the evidence at the time of the custody event;
•  Storage location of the evidence following the custody event; and
•  Any observations, anomalies, or exceptions noted during the custody event.
The full, detailed chain of custody log is appended to this Certification as Exhibit C. The following table provides a summary of the key custody events during the Collection Period:
The above summary reflects the key milestones of the collection and transfer process. Detailed, granular custody entries (including individual custodian-level and device-level entries) are documented in the full chain of custody log in Exhibit C.
7. Personnel Involved
The following Linden Forensics personnel performed or supervised the forensic collection, processing, and data transfer activities described in this Certification:
All personnel identified above hold current, active certifications in the relevant fields of digital forensics, mobile device forensics, and/or electronic discovery, as indicated. Certification credentials are maintained in personnel files at Linden Forensics and are available for verification upon request.
All Linden Forensics personnel who participated in this engagement are bound by the confidentiality obligations set forth in the May 8, 2023 Engagement Letter between Linden Forensics and C&H. Additionally, all personnel have executed Linden Forensics' standard internal confidentiality and non-disclosure agreements, which impose obligations of confidentiality with respect to all client data, case information, and work product.
No Linden Forensics personnel other than those identified above had access to the collected data, forensic images, or any information relating to this engagement.
8. Exceptions and Observations
Linden Forensics is required, under its standard operating procedures and the terms of the Engagement Letter, to document and disclose any exceptions, anomalies, or deviations from the Forensic Collection Protocol encountered during the collection, processing, or transfer of ESI. The following exceptions and observations are noted:
No Material Exceptions. Linden Forensics confirms that no material exceptions were encountered during the forensic collection. All nine (9) custodians' data was successfully collected from all identified data sources (corporate email, Meridian Solutions workspace messages, text messages/SMS/Westmark Software from company-issued mobile devices, and shared network drives/departmental file shares). No data sources identified in the Forensic Collection Protocol were inaccessible, corrupted, or otherwise unavailable for collection.
Marcus Hale Personal Mobile Device. It is noted that Marcus Hale's personal mobile device was not within the scope of the Forensic Collection Protocol and was not collected or imaged by Linden Forensics. The collection of Mr. Hale's mobile communications was limited to his company-issued mobile device (Ashbury Corporation 14 Pro, APS asset tag No. APS-MOB-2287). Text messages, SMS, and Ashbury Health IT were collected from the company-issued device. C&H has advised that, to the extent carrier-level call and message records for Mr. Hale's company-issued device number are available, such records have been or will be obtained separately through a carrier records request and are not within the scope of this Certification.
Meridian Solutions Data Export Completeness. APS maintains a Meridian Solutions Enterprise Grid workspace with a data retention policy that retains all messages. No Meridian Solutions messages within the specified date range were unavailable due to deletion or retention policy limitations. The Meridian Solutions data export was confirmed to be complete for all nine custodians.
Mobile Device Availability. All company-issued mobile devices for the nine custodians were available for forensic imaging during the Collection Period. No device was reported lost, damaged, or otherwise unavailable. All devices were returned to custodians (Custodians 2 through 9) upon completion of imaging. Mr. Hale's company-issued device is retained in Linden Forensics' custody at C&H's direction.
Encrypted Containers. No encrypted containers, password-protected files, or other access-restricted data objects that could not be accessed during processing were identified in the collected data set. All collected data was fully accessible and processable.
In summary, the forensic collection proceeded in accordance with the Forensic Collection Protocol without material deviation, and Linden Forensics has no exceptions, anomalies, or concerns to report regarding the integrity, completeness, or defensibility of the collection.
9. Certification Statement
Linden Forensics Group Inc., by and through the undersigned Engagement Manager, hereby formally certifies as follows:
1. The forensic collection described in this Certification was conducted in strict accordance with the Forensic Collection Protocol provided by Calderwood & Harkness LLP, dated May 8, 2023, including the scope, custodian identification, data source specifications, date range, and search-term parameters set forth therein.
2. All electronically stored information was collected using forensically sound, defensible methodology, including the use of write-blocked imaging technology, bit-for-bit forensic imaging (where applicable), logical acquisitions, and industry-standard mobile device forensic extraction tools. The collection methodology adheres to generally accepted forensic standards and best practices, as described in Section 3.4 of this Certification.
3. SHA-256 cryptographic hash values were computed for all collected data at the point of acquisition and were verified post-transfer to Calderwood & Harkness LLP's designated secure hosted review platform. In all instances, the post-transfer hash values matched the original acquisition-time hash values, confirming the integrity and authenticity of all collected data. No alterations, additions, deletions, or unauthorized modifications occurred at any stage of the collection, processing, or transfer workflow.
4. The chain of custody for all physical and digital evidence was maintained at all times, from the initial point of collection at APS headquarters on May 10, 2023 through the secure transfer of the filtered data set to Calderwood & Harkness LLP's review platform on May 12, 2023, and continuing through the ongoing secure storage of original forensic images at Linden Forensics' evidence storage facility. The chain of custody is documented in contemporaneous, written logs appended to this Certification as Exhibit C.
5. A total of approximately 847,000 documents, communications, and files were collected across all nine (9) identified custodians and all identified data sources. Following industry-standard de-duplication, the data set was reduced to approximately 214,000 unique items. After application of the search-term and date-range filters specified in the Forensic Collection Protocol, approximately 38,600 items were identified for attorney review and loaded to Calderwood & Harkness LLP's secure review platform.
6. All work described in this Certification was performed by Linden Forensics Group Inc. in its capacity as agent of counsel, at the direction of and under the supervision of Calderwood & Harkness LLP, in connection with privileged legal services rendered to Aurelius Global Media Group PLC. All data, work product, forensic images, logs, and documentation generated in connection with this engagement are protected by the attorney-client privilege and attorney work-product doctrine.
This Certification is made based on the personal knowledge and professional judgment of the undersigned and the Linden Forensics team members identified in Section 7 above. The undersigned affirms that the foregoing statements are true and accurate to the best of his knowledge, information, and belief, formed after reasonable inquiry.
10. Signature block
LINDEN FORENSICS GROUP INC.
By: ________
Name: Nathaniel R. Park
Title: Engagement Manager
Date: May 12, 2023
Linden Forensics Group Inc. 201 Mission Street, Suite 1400 San Francisco, CA 94105 Telephone: (415) 555-0172
Email: npark@lindenforensics.com
Exhibits
The following exhibits are referenced in this Certification and are appended hereto. Exhibits A through D are incorporated by reference and form an integral part of this Chain of Custody Certification.
Exhibit A — Custodian Identification List
A complete list of all nine (9) custodians identified for forensic data collection, including full legal names, titles, departmental affiliations within Aurelius Pacific Studios Inc., and a detailed specification of the data sources collected for each custodian. Exhibit A also includes the unique custodian identification numbers assigned by Linden Forensics for tracking and documentation purposes.
[Exhibit A is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]
Exhibit B — Hash Verification Logs
Complete SHA-256 cryptographic hash verification logs for all forensic images and transferred data sets, including:
•  Hash values computed at the time of forensic acquisition;
•  Hash values recomputed post-processing;
•  Hash values recomputed post-transfer to Calderwood & Harkness LLP's review platform; and
•  Verification results confirming the match of all hash values at each stage.
[Exhibit B is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]
Exhibit C — Detailed Chain of Custody Log
The complete, contemporaneous chain of custody log documenting every custody event for all physical and digital evidence collected during this engagement. The log includes granular date/time entries, identity of all transferring and receiving personnel, descriptions of evidence items, associated hash values, storage locations, and any observations or exceptions noted during each custody event.
[Exhibit C is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]
Exhibit D — Collection Equipment and Software Inventory
A comprehensive inventory of all forensic collection equipment and software tools used during the Collection Period, including:
•  Hardware write-blockers (manufacturer, model, serial number);
•  Forensic imaging software (name, version number, license information);
•  Mobile device forensic tools (name, version number, license information);
•  Processing and de-duplication software (name, version number);
•  Encryption tools (name, version number); and
•  Calibration and validation records for all equipment and software, confirming that all tools were operating within validated parameters during the Collection Period.
[Exhibit D is maintained under separate cover and is available upon request from Linden Forensics Group Inc. or Calderwood & Harkness LLP.]
— End of Certification —
Custodian No. | Full Name | Title | Entity
1 | Marcus Hale | President | Aurelius Pacific Studios Inc.
2 | Jenna Morales | Vice President of Development | Aurelius Pacific Studios Inc.
3 | Claire Ngo | Senior Director of Talent Relations | Aurelius Pacific Studios Inc.
4 | Darren Whitfield | Senior Vice President of Physical Production | Aurelius Pacific Studios Inc.
5 | Victor Gallegos | Vice President of Human Resources | Aurelius Pacific Studios Inc.
Date | Time (PDT) | Custody Event | Description
May 10, 2023 | 08:00 AM | Collection Commenced | Linden Forensics team arrived on-site at APS headquarters. Credentials and systems access confirmed with APS IT. Collection of corporate email (Strathmore Data Systems) and Meridian Solutions workspace data commenced for Custodians 1 through 5. Hale's company-issued mobile device received from APS HR (asset tag APS-MOB-2287).
May 10, 2023 | 06:45 PM | Daily Collection Checkpoint | Email and Meridian Solutions data collection completed for Custodians 1 through 3. Forensic imaging of Hale's mobile device commenced. All collected data secured in Linden Forensics' on-site evidence storage (locked, access-controlled workroom at APS).
May 11, 2023 | 07:30 AM | Collection Continued | Email and Meridian Solutions data collection commenced for Custodians 6 through 9. Completion of email and Meridian Solutions data collection for Custodians 4 and 5. Mobile device forensic imaging commenced for Custodians 2 through 5.
May 11, 2023 | 10:00 AM | Shared Drive Collection | Collection of shared network drive and departmental file share data commenced for all nine (9) identified custodians.
May 11, 2023 | 07:15 PM | Daily Collection Checkpoint | Email and Meridian Solutions data collection completed for Custodians 6 through 9. Mobile device imaging completed for Custodians 2 through 7. Shared drive collection ongoing. All collected data secured in on-site evidence storage.
May 12, 2023 | 07:30 AM | Collection Continued | Mobile device imaging completed for Custodians 8 and 9. Shared drive collection finalized. All company-issued mobile devices returned to custodians (Custodians 2–9). Hale's device retained in Linden Forensics custody per C&H direction.
May 12, 2023 | 11:00 AM | Collection Completed | All forensic data collection activities completed. SHA-256 hash values computed for all forensic images.
May 12, 2023 | 12:30 PM | Processing & De-Duplication | Processing, de-duplication, and search-term/date-range filtering finalized. Filtered data set of approximately 38,600 items prepared for transfer.
May 12, 2023 | 03:00 PM | Data Transferred | Filtered data set transferred via AES-256 encrypted file transfer to C&H's designated secure hosted review platform. Post-transfer SHA-256 hash verification completed; all hash values confirmed to match.
May 12, 2023 | 04:30 PM | Evidence Secured | All original forensic images, collection media, forensic examiner logs, and associated documentation packaged for secure transport to Linden Forensics' evidence storage facility in San Francisco.
Name | Role | Certifications
Nathaniel R. Park | Engagement Manager | Certified Computer Examiner (CCE); Penrose Technologies Certified Examiner (EnCE); Certified Forensic Computer Examiner (CFCE)
Lisa M. Okonkwo | Senior Forensic Examiner | Penrose Technologies Certified Examiner (EnCE); Westmark Data Systems Certified Examiner (ACE); Sundial Services Inc. Certified Mobile Examiner (CCME)
Ryan T. Gallagher | Forensic Examiner | Penrose Technologies Certified Examiner (EnCE); Sundial Services Inc. Certified Physical Analyst (CCPA)
Priya S. Chandra | Forensic Examiner | Westmark Data Systems Certified Examiner (ACE); Sundial Services Inc. Certified Mobile Examiner (CCME); Certified Information Systems Security Professional (CISSP)
Daniel K. Wu | Processing Analyst | Relativity Certified Administrator (RCA); Severin Software Certified User; Certified eDiscovery Specialist (CEDS)

CHAIN OF CUSTODY CERTIFICATION

LINDEN FORENSICS GROUP INC.

Record

Parties

Dates

Amounts