1038-00006 · Calderwood & Harkness LLP · Court Filings

declaration-anand-forensic-tro.docx DOCUMENT Finance & Banking

20 / 79 ← → ✕

IN THE COURT OF CHANCERY OF THE STATE OF DELAWARE

DECLARATION OF DR. RAJIV ANAND IN SUPPORT OF PLAINTIFF'S MOTION FOR TEMPORARY RESTRAINING ORDER AND PRELIMINARY INJUNCTION

I, Dr. Rajiv Anand, hereby declare under penalty of perjury pursuant to 10 Del. C. § 3927 as follows:

This declaration is submitted in support of Plaintiff Cascade Retail Holdings Inc.'s ("CRH" or "Plaintiff") Motion for Temporary Restraining Order and Preliminary Injunction. I make this declaration based on my personal knowledge and professional expertise in digital forensics and data exfiltration analysis, except where otherwise indicated. Where statements are made on information and belief, I identify the basis for such belief. I am competent to testify to the matters stated herein, and if called as a witness, could and would testify competently thereto.

I. QUALIFICATIONS AND BACKGROUND OF DECLARANT

1. My name is Dr. Rajiv Anand. I am the Engagement Lead of the Digital Forensics Division at Pinnacle Forensics LLC ("Pinnacle"), a nationally recognized digital forensics and electronic discovery consulting firm. My business address is 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910. I have held my current position at Pinnacle since 2018 and have been employed by Pinnacle in various capacities since 2014.

2. I hold a Doctor of Philosophy (Ph.D.) in Computer Science, with a specialization in digital forensics and information security, from the University of Maryland, College Park, which I received in 2009. I also hold a Master of Science in Computer Engineering from Virginia Polytechnic Institute and State University (Virginia Tech), conferred in 2005, and a Bachelor of Science in Electrical Engineering from the Georgia Institute of Technology, conferred in 2003. I hold the following professional certifications relevant to the forensic work described in this declaration: Certified Computer Examiner (CCE), issued by the International Society of Forensic Computer Examiners; Penrose Technologies Certified Examiner (EnCE), issued by Thackeray Solutions; GIAC Certified Forensic Examiner (GCFE), issued by the SANS Institute; and Certified Information Systems Security Professional (CISSP), issued by the International Information Systems Security Certification Consortium, or (ISC)². I have maintained all of these certifications in active status through continuing professional education. Over the course of my career, I have accumulated more than fifteen (15) years of experience in the field of digital forensics, including extensive work in the areas of corporate data exfiltration investigations, trade secret misappropriation matters, and litigation support relating to the enforcement of restrictive covenants such as non-competition and non-solicitation agreements.

3. Throughout my career, I have been retained as a forensic expert in approximately eighty-five (85) litigation matters in federal and state courts across the United States, as well as in arbitration proceedings. I have testified as a qualified expert witness on approximately thirty (30) occasions in federal and state courts, including on two prior occasions in the Delaware Court of Chancery. My expert testimony has addressed subjects including forensic imaging methodology, digital chain of custody, analysis of file system metadata and audit logs, identification of data exfiltration patterns, and the reconstruction of deleted digital evidence. I have published peer-reviewed articles on topics related to digital forensics in the Journal of Digital Forensics, Security and Law, the International Journal of Electronic Security and Digital Forensics, and the Digital Investigation journal. I am a member of the American Academy of Forensic Sciences (Digital and Multimedia Sciences Section), the High Technology Crime Investigation Association, and the International Association of Computer Investigative Specialists. A true and correct copy of my curriculum vitae, which sets forth my educational background, professional certifications, publications, and expert testimony history in further detail, is attached hereto as Exhibit 1.

4. I was retained by Calderwood & Harkness LLP, counsel for Plaintiff Cascade Retail Holdings Inc., on February 20, 2025. The scope of my engagement encompasses the following: (a) the forensic imaging and analysis of CRH-issued electronic devices returned by the eight departing employees identified in this litigation (collectively referred to herein as the "Rathore Group"); (b) the analysis of cloud access logs and data transfer records from CRH's enterprise systems, including CRH's Sundial Systems, Pinnacle Health IT, Strathmore Data Systems, and Aldermere Services Inc. environments; and (c) the identification, characterization, and quantification of any data exfiltration activities undertaken by members of the Rathore Group using CRH's devices and enterprise systems. In conducting this engagement, I have overseen a team of four forensic analysts at Pinnacle, each of whom holds relevant professional certifications and has significant experience in corporate data exfiltration investigations. I have personally directed all phases of the forensic examination, reviewed the work product of my team, and verified the findings presented in this declaration.

II. SCOPE OF FORENSIC EXAMINATION

5. On February 21, 2025, Pinnacle received and took custody of CRH-issued electronic devices that had been returned by each of the eight departing employees upon or shortly after their simultaneous resignations on February 7, 2025. These devices had been collected by CRH's Information Technology Department on or about February 10, 2025, and stored in a secure, access-controlled location at CRH's corporate headquarters pending transfer to Pinnacle. The devices received by Pinnacle included the following:

(a) Eight (8) CRH-issued laptop computers (Kestrel Solutions series), one assigned to each member of the Rathore Group;

(b) Eight (8) CRH-issued mobile phones (Brightwater Systems), one assigned to each member of the Rathore Group; and

(c) No external storage media were returned by any member of the Rathore Group. CRH's IT Department confirmed that no USB drives, portable hard drives, or other external storage devices were included among the returned materials, despite CRH's device return policy requiring the return of all CRH-issued or CRH-associated storage media.

Each device was identified by employee assignment, device type, serial number, and CRH asset tag number. A summary table identifying each device, its assigned user, serial number, and CRH asset tag is set forth in Exhibit 2 to this declaration. Pinnacle created forensically sound, bit-for-bit images of each device upon receipt, as described further in Section VII below.

6. In addition to the physical devices, Pinnacle's examination encompassed the following CRH enterprise systems and cloud environments:

(a) CRH's Sundial Systems Environment: CRH utilizes Sundial Systems as its enterprise document management system. The merchandising division, of which all eight members of the Rathore Group were part, maintained extensive document libraries on containing strategic planning documents, vendor negotiation materials, financial models, analytics reports, and other confidential business records. Pinnacle reviewed Aldermere Systems audit logs capturing file access, download, modification, and sharing activity by the Rathore Group members.

(b) CRH's Pinnacle Health IT Environment: CRH utilizes the Pinnacle Health IT platform as its customer relationship management and vendor management system. The Pinnacle Health IT instance contains vendor contact information, pricing data, rebate structures, customer segmentation data, and related business intelligence. Pinnacle reviewed Pinnacle Health IT event monitoring logs capturing data export activity, report generation, and login events attributable to Rathore Group members.

(c) CRH's Cloud Access and Activity Logging Infrastructure: Pinnacle reviewed Aldermere Services Inc. ("Azure AD") sign-in logs, which record authentication events and session details for users accessing CRH's Ashgrove Software and Azure-hosted services. These logs include timestamp, user identity, IP address, device information, and access outcome (success or failure) for each sign-in event.

(d) CRH's Email System: CRH utilizes Cobalt Ridge Data Systems (Ridgeline Services Inc.) as its enterprise email and calendar platform. Pinnacle reviewed email server logs, including message tracking logs and mailbox audit logs, for the relevant Rathore Group accounts.

CRH's IT Department, under the direction of CRH's Chief Information Security Officer, provided Pinnacle with administrative-level access credentials and comprehensive audit log exports for each of the above systems covering the relevant time period. All log data was provided in native format with associated metadata intact.

7. Pinnacle conducted the forensic examination using industry-standard forensic imaging protocols and analysis methodologies, consistent with best practices recognized by the digital forensics community and applicable professional standards. The specific methodologies employed in this engagement included the following:

(a) Forensic Imaging: Bit-for-bit forensic images of all physical devices were created using Westvale Health IT forensic write-blockers (hardware-based) to prevent any alteration to the original evidence media during the imaging process. Forensic images were captured using Stonefield Software (Version 23.4) and verified through the generation and comparison of cryptographic hash values (both MD5 and SHA-256) for each image against the original media.

(b) Chain of Custody: A documented chain of custody was maintained for all physical devices and digital evidence from the point of receipt through the completion of analysis. Each item of evidence was assigned a unique Pinnacle case evidence number and logged in Pinnacle's secure evidence management system.

(c) Analysis Tools: Forensic analysis was conducted using Stonefield Software (Version 23.4), Camberwell Systems ("Ostrander Solutions") (Version 8.0), and Axiom Examine (Version 7.8), supplemented by custom scripts developed by Pinnacle for targeted log analysis and correlation.

(d) Evidence Reviewed: The analysis encompassed file system metadata (including NTFS Master File Table records, file creation/modification/access timestamps, and file path data); web browser histories and cached data (across Chrome, Edge, and Firefox browsers); USB connection logs (Windows Registry entries and Windows Event Logs recording USB device connection and disconnection events); cloud sync client logs (Cobalt Ridge Systems, Hollowell Health IT, and Larkspur Technologies desktop client activity logs); email headers and message metadata; and enterprise-side audit trails as described above.

(e) Analysis Period: The primary analysis period focused on the timeframe from October 1, 2024 through February 10, 2025. This period was selected to capture activity beginning shortly after the completion of CRH's strategic initiative known internally as "Project Ridgeline" (completed in October 2024) through the date on which CRH disabled the Rathore Group members' enterprise credentials following their resignations. Certain analyses, including post-resignation access attempts, extended through February 10, 2025.

III. SUMMARY OF KEY FINDINGS — DATA EXFILTRATION

8. Based on the forensic analysis described above, Pinnacle identified significant and sustained unauthorized data transfer activity by members of the Rathore Group during the period from January 10, 2025 through February 4, 2025 — a twenty-six (26) day window. During this period, members of the Rathore Group collectively transferred a total of 14,327 files from CRH's enterprise systems (principally Aldermere Systems and Pinnacle Health IT) to personal cloud storage accounts that were not authorized, managed, or controlled by CRH. The total data volume of these transfers was approximately 2.8 gigabytes (GB). The transfers were made to personal (non-CRH) cloud storage services, including personal Hollowell Health IT accounts, personal Larkspur Technologies accounts, and, in certain instances, personal Severin Services Inc. accounts that were distinct from the employees' CRH-managed enterprise Cobalt Ridge Systems accounts. These personal cloud storage destinations were identified through analysis of browser history artifacts, cloud sync client configuration files recovered from the CRH-issued laptops, and correlation with CRH's enterprise audit logs.

9. The timeline of the exfiltration activity identified by Pinnacle is as follows:

(a) January 10, 2025 — Onset of Exfiltration Activity: The earliest identified unauthorized data transfer occurred on January 10, 2025. I have been informed by counsel that this date falls four days after a dinner meeting that took place on January 6, 2025, at a restaurant in New York City, between Verdana Commerce Group CEO Warren Dietrich, Greystone Capital Partners Managing Partner Elliot Westbrook, and Defendant Priya Rathore. While I express no opinion regarding the significance of that meeting, I note that no comparable data transfer activity was identified in the analysis period prior to January 10, 2025 — that is, the forensic analysis of the October 1, 2024 through January 9, 2025 period revealed no pattern of bulk downloads or transfers to personal cloud storage accounts by any member of the Rathore Group.

(b) January 13–24, 2025 — Escalation Phase: Data exfiltration activity increased substantially during the period from January 13 through January 24, 2025. During this twelve-day window, approximately 5,860 files were transferred to personal cloud storage accounts by members of the Rathore Group, representing approximately 41% of the total exfiltrated file count. I have been informed by counsel that this period coincides with encrypted messaging exchanges among members of the Rathore Group regarding their coordinated departure from CRH, though the content of those messages is outside the scope of my forensic analysis of CRH's enterprise systems.

(c) January 27 – February 3, 2025 — Peak Activity Phase: The highest concentration of data transfer activity occurred during the period from January 27 through February 3, 2025. During this eight-day window, approximately 6,412 files were transferred, representing approximately 45% of the total exfiltrated file count. The daily volume of transferred files during this period exceeded 800 files per day on multiple occasions, with a single-day peak of 1,247 files on January 29, 2025. I have been informed by counsel that this period coincides with the execution of employment offer letters between Verdana Commerce Group and the individual members of the Rathore Group.

(d) February 4, 2025 — Final Exfiltration Activity: The last identified unauthorized data transfer occurred on February 4, 2025, three days before the simultaneous resignations of all eight members of the Rathore Group on February 7, 2025. On this date, a final batch of approximately 418 files was transferred, primarily by Defendants Rathore and Halvorsen.

(e) Pattern of After-Hours and Weekend Activity: A significant proportion of the identified data transfer activity — approximately sixty-two percent (62%) by file count — occurred outside of normal business hours (defined as 8:00 AM to 6:00 PM Pacific Time, Monday through Friday). Specifically, substantial download and transfer activity was identified during evening hours (after 8:00 PM PT), early morning hours (before 6:00 AM PT), and on weekends. This pattern of after-hours and weekend activity is, in my professional opinion, consistent with deliberate efforts to avoid detection during periods of lower network monitoring and reduced colleague presence.

A detailed timeline chart depicting daily exfiltration volumes and the correlation with key events identified by counsel is attached hereto as Exhibit 3.

10. The following table sets forth a breakdown of the exfiltration activity attributable to each individual member of the Rathore Group, based on Pinnacle's forensic analysis:

As reflected above, Defendant Priya Rathore was the largest individual contributor, accounting for approximately 29.4% of the total exfiltrated files and approximately 31.3% of the total data volume. A detailed summary table listing the exfiltrated files by employee, date, source system, and file category is attached hereto as Exhibit 2.

IV. NATURE AND CLASSIFICATION OF EXFILTRATED FILES

11. Pinnacle conducted a content-level review and classification of the 14,327 exfiltrated files. Based on that analysis, the files were classified into the following categories:

(a) Project Ridgeline Materials (approximately 3,847 files): This category comprises presentations, strategic planning documents, financial projections, market analyses, and supporting analytical workbooks relating to CRH's five-year category expansion roadmap completed in October 2024, known internally as "Project Ridgeline." Based on my review of these materials and the information provided to me regarding CRH's business operations, these materials contain proprietary vendor negotiation strategies detailing CRH's approach to securing favorable terms with key suppliers; private-label margin targets reflecting CRH's internal profitability benchmarks and pricing philosophy for its owned brands; and ecommerce assortment algorithms describing CRH's proprietary methodology for selecting and optimizing product assortments across its digital channels. Project Ridgeline materials were accessed and downloaded by all eight members of the Rathore Group, with the largest concentrations attributable to Defendants Rathore, Linden, and Kaczmarek.

(b) Vendor Negotiation Term Sheets (approximately 2,631 files): This category comprises confidential term sheets, memoranda of understanding, and related negotiation correspondence reflecting CRH's negotiated pricing, volume-based rebate structures, promotional allowance terms, and exclusivity arrangements with key vendors across multiple product categories, including home goods, seasonal décor, hardlines, and softlines. These materials were primarily downloaded by Defendants Linden, Kaczmarek, and Fernandez-Gill.

(c) Private-Label Cost Models (approximately 2,208 files): This category comprises proprietary financial models, cost-of-goods analyses, margin waterfall spreadsheets, and pricing strategy documents relating to CRH's private-label product lines, including the "Veltrano Home," "Seasoncraft," and "ArcticThread" brands. These materials detail raw material sourcing costs, manufacturing costs, logistics costs, target retail prices, and resulting margin structures at a granular product-SKU level. These materials were primarily downloaded by Defendants Osei and Rathore.

(d) Customer Segmentation Data (approximately 2,146 files): This category comprises detailed customer analytics reports, segmentation models, demographic and psychographic profiles, purchase behavior analyses, and related datasets used by CRH's merchandising division to inform product assortment decisions, promotional targeting strategies, and channel allocation decisions. These materials were primarily downloaded by Defendants Halvorsen, Tsao, and Johansson.

(e) Seasonal Buying Algorithms (approximately 1,723 files): This category comprises proprietary algorithms, analytical frameworks, demand forecasting models, and related technical documentation used by CRH for seasonal merchandise planning, open-to-buy management, and inventory optimization across CRH's retail and ecommerce channels. These materials reflect years of development and refinement by CRH's analytics teams. These materials were primarily downloaded by Defendants Halvorsen and Johansson.

(f) Other Confidential Business Documents (approximately 1,772 files): This category comprises internal memoranda, competitive intelligence analyses, organizational charts, vendor contact databases (including key contact names, email addresses, phone numbers, and relationship notes), meeting minutes, budget documents, and related operational documents of CRH's merchandising division. These materials were downloaded by various members of the Rathore Group.

12. A significant number of the exfiltrated files bore CRH confidentiality markings embedded in the documents themselves. Specifically, Pinnacle's content analysis identified the following markings appearing on exfiltrated files:

(a) "CRH CONFIDENTIAL" — appearing on approximately 8,941 of the 14,327 exfiltrated files (approximately 62.4%);

(b) "CRH — INTERNAL USE ONLY" — appearing on approximately 3,287 of the exfiltrated files (approximately 22.9%);

(c) "PROJECT RIDGELINE — RESTRICTED DISTRIBUTION" — appearing on approximately 2,614 of the exfiltrated files (approximately 18.2%), all of which were a subset of the Project Ridgeline materials category described above; and

(d) "CRH HIGHLY CONFIDENTIAL — EXECUTIVE ACCESS ONLY" — appearing on approximately 1,106 of the exfiltrated files (approximately 7.7%), representing materials designated at the highest tier under CRH's information classification policies.

I have been provided with and have reviewed CRH's Information Security Policy (revised effective January 1, 2024) and its associated Data Classification Guidelines. Based on that review, I understand that materials bearing the "CRH HIGHLY CONFIDENTIAL — EXECUTIVE ACCESS ONLY" and "PROJECT RIDGELINE — RESTRICTED DISTRIBUTION" designations are subject to the most restrictive handling requirements under CRH's policies, including prohibitions on transmission to external parties, storage on personal devices, and transfer to non-CRH cloud environments. The Rathore Group's transfer of these materials to personal cloud storage accounts was, to my understanding, directly contrary to these policies. Representative samples of exfiltrated file names and metadata showing these confidentiality markings are attached hereto as Exhibit 4 (redacted as necessary to protect trade secret content).

13. The categories of exfiltrated data described above correspond directly to what I understand to be CRH's core competitive advantages in the omnichannel retail space, particularly in home goods, seasonal décor, and private-label apparel. I have been informed by counsel that Verdana Commerce Group, Inc. ("Verdana") has publicly announced expansion plans in these same product categories and that Verdana directly competes with CRH in twenty-eight (28) overlapping product categories. While I express no legal opinion regarding the competitive implications of the data exfiltration, I note as a factual matter that possession of these materials — including CRH's proprietary vendor pricing and rebate terms, private-label cost structures and margin targets, seasonal demand forecasting algorithms, and customer segmentation models — by any direct competitor would provide that competitor with a significant and detailed window into CRH's strategic positioning, pricing philosophy, cost structure, and analytical capabilities, information that would ordinarily require years of independent development and substantial capital investment to replicate.

V. METHODS OF EXFILTRATION

14. Aldermere Systems Downloads to Personal Cloud Storage. Cloud access logs from CRH's Aldermere Systems environment, corroborated by browser history artifacts and cloud sync client logs recovered from the CRH-issued laptops, reveal the following pattern of activity. Members of the Rathore Group accessed Aldermere Systems document libraries using their CRH credentials through web browser sessions (primarily Ashford Services Inc. and Penrose Systems) and, in some cases, through the Aldermere Systems desktop sync client integrated with their CRH-managed Larkspur Health IT accounts. Files were downloaded from Aldermere Systems to the local hard drives of the CRH-issued laptops. Subsequently, these files were uploaded — either manually through web browser uploads or automatically through desktop sync clients — to personal cloud storage accounts not associated with or managed by CRH. The specific personal cloud services identified as exfiltration destinations include: personal Hollowell Health IT accounts (identified through browser history artifacts, Hollowell Health IT desktop client configuration files, and authenticated session cookies); personal Larkspur Technologies accounts (identified through Larkspur Technologies desktop client installation artifacts, configuration databases, and file sync logs); and personal Severin Services Inc. accounts distinct from the employees' CRH enterprise Cobalt Ridge Systems accounts (identified through Cobalt Ridge Systems client configuration files referencing personal Microsoft account credentials). In certain instances, Pinnacle identified that Rathore Group members created new personal cloud storage accounts during the exfiltration period specifically for the purpose of receiving the downloaded CRH files, as evidenced by account creation confirmation emails found in browser cache artifacts.

15. Pinnacle Health IT Data Exports. Pinnacle Health IT event monitoring logs provided by CRH reveal that certain members of the Rathore Group — specifically, Defendants Fernandez-Gill, Linden, and Osei — executed bulk data exports from CRH's Pinnacle Health IT instance during the January 10 – February 4, 2025 period. These exports were accomplished through Pinnacle Health IT's native data export and report export functionality. The exported data included vendor contact records (names, titles, email addresses, phone numbers, and relationship history notes for key vendor contacts); pricing data (negotiated unit prices, volume discount tiers, and promotional pricing terms by vendor and product category); and customer segmentation reports (aggregate customer demographic data, purchase frequency analyses, and segment-level profitability reports). Pinnacle Health IT event monitoring logs record these export events with timestamps, user identifiers, record counts, and data object types. The exported data was saved to local laptop storage and subsequently transferred to personal cloud storage accounts using the methods described in the preceding paragraph.

16. USB and External Media Activity. Forensic imaging and analysis of the eight CRH-issued laptops revealed USB connection logs — specifically, Windows Registry entries under HKEY\LOCAL\MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR and corresponding Windows Event Log entries (Event IDs 2003 and 2100) — indicating that personal USB storage devices were connected to CRH-issued laptops by multiple members of the Rathore Group during the January 10 – February 4, 2025 period. The USB devices identified through these artifacts include the following:

(a) A Harborline Technologies USB 3.0 flash drive (64 GB capacity), serial number 4C530001260817116292, connected to the laptop assigned to Defendant Rathore on January 14, January 22, and January 30, 2025;

(b) A Beaumont Solutions portable SSD (500 GB capacity), serial number S5NENG0R502378M, connected to the laptop assigned to Defendant Halvorsen on January 18 and January 29, 2025;

(c) A Adriatic Health IT USB 3.2 flash drive (128 GB capacity), serial number 60A44C41370CBF31, connected to the laptop assigned to Defendant Linden on January 20, January 26, and February 1, 2025; and

(d) A Strathmore Systems portable hard drive (1 TB capacity), serial number WX92A95JZE5E, connected to the laptop assigned to Defendant Tsao on January 23 and February 3, 2025.

File system artifacts — including Windows Shellbag entries, link (LNK) files, and Jump List data — confirm that file copy operations were performed to these USB devices during the connected sessions. The file paths recorded in these artifacts correspond to directories containing CRH documents previously downloaded from Aldermere Systems. Critically, none of these USB devices were among the materials returned by any member of the Rathore Group to CRH upon their resignation. This finding indicates that copies of CRH's confidential and proprietary data may exist on personal external storage media that have not been returned, accounted for, or made available for forensic examination. Extracts from the USB connection logs are attached hereto as Exhibit 5.

17. Deletion and Concealment Activity. Forensic analysis identified substantial evidence of deliberate deletion and concealment activity on multiple CRH-issued devices prior to their return on or about February 7, 2025. Specifically, Pinnacle identified the following:

(a) Browser History Deletion: On the laptops assigned to Defendants Rathore, Linden, Kaczmarek, and Halvorsen, browser history data (including download history) for the Ashford Services Inc. and Penrose Systems browsers had been manually cleared on or about February 5–6, 2025. The browser history databases reflected deletion timestamps consistent with manual clearing operations rather than automated cache management.

(b) Cloud Sync Client Removal: On the laptops assigned to Defendants Rathore, Osei, and Tsao, the Hollowell Health IT desktop sync client and/or Larkspur Technologies desktop sync client had been uninstalled on or about February 5–6, 2025. Residual uninstallation artifacts, including Windows Installer logs and Prefetch file entries, confirm the timing of these removals.

(c) Recycle Bin Emptying and Secure Deletion: On the laptops assigned to Defendants Rathore and Halvorsen, Pinnacle identified evidence that the Windows Recycle Bin had been emptied on February 6, 2025. Additionally, on Defendant Rathore's laptop, Pinnacle identified artifacts consistent with the use of a file-wiping utility (Brightmoor Health IT, Version 6.19) on February 6, 2025, indicating an attempt to securely delete files and overwrite their contents to prevent forensic recovery.

(d) Email Deletion: Mailbox audit logs for the CRH Exchange accounts of Defendants Rathore, Linden, and Kaczmarek show substantial email deletion activity on February 5–6, 2025, including the permanent deletion (bypassing the Deleted Items folder) of emails with attachments and emails relating to file sharing and cloud storage links.

Despite these deletion efforts, Pinnacle's forensic recovery techniques — including analysis of unallocated disk space, Volume Shadow Copies, Windows Event Logs, NTFS journal entries ($UsnJrnl), and Prefetch files — allowed Pinnacle to reconstruct the data transfer activity in substantial detail. Additionally, the enterprise-side audit trails maintained by CRH's Aldermere Systems, Pinnacle Health IT, and Azure AD systems were unaffected by the deletion activity on the individual laptops, as those logs are maintained at the server level and were not within the Rathore Group members' ability to modify or delete. The pattern of deletion activity described above is, in my professional opinion, consistent with deliberate and coordinated attempts to conceal the scope and nature of the data exfiltration prior to the return of CRH-issued devices.

VI. ANALYSIS OF CLOUD ACCESS LOGS POST-RESIGNATION

18. CRH's IT Department disabled enterprise credentials (Aldermere Services Inc. accounts) for all eight members of the Rathore Group upon notification of their resignations. I have been informed that the resignations were submitted on Friday, February 7, 2025, and that credential deactivation was completed on Monday, February 10, 2025 — the first business day following the resignations. During the intervening period — specifically, from the evening of February 7, 2025 through February 9, 2025 (a weekend period) — CRH's Aldermere Services Inc. sign-in logs and Aldermere Systems audit logs record multiple access attempts to CRH's enterprise systems using credentials belonging to members of the Rathore Group. The following access attempts were identified:

(a) On February 7, 2025, between 7:42 PM and 11:18 PM Pacific Time, seven (7) sign-in attempts were made to CRH's Aldermere Systems environment using the credentials of Defendant Rathore. Four of these attempts were successful, resulting in authenticated sessions during which additional Aldermere Systems document library browsing activity was recorded. The source IP addresses for these attempts (104.28.xx.xx range) resolved to a residential internet service provider in the Seattle metropolitan area and were not associated with CRH's corporate network or VPN infrastructure.

(b) On February 8, 2025, between 9:14 AM and 2:47 PM Pacific Time, four (4) sign-in attempts were made to CRH's Pinnacle Health IT environment using the credentials of Defendant Fernandez-Gill. Three of these attempts were successful. The source IP addresses (73.181.xx.xx range) resolved to a residential internet service provider in the Portland, Oregon area.

(c) On February 9, 2025, between 10:03 AM and 6:31 PM Pacific Time, eleven (11) sign-in attempts were made across CRH's Aldermere Systems and Pinnacle Health IT environments using the credentials of Defendants Rathore, Linden, and Halvorsen. Six of these attempts were successful. The source IP addresses for these attempts did not correspond to CRH's corporate network and resolved to residential internet service providers in the Seattle and Bellevue, Washington areas.

All access attempts ceased after credential deactivation on February 10, 2025. The post-resignation access attempts described above originated from IP addresses not associated with CRH's corporate network, strongly suggesting that these access events were initiated from personal devices or personal internet connections outside of CRH's premises. A log extract documenting these post-resignation access attempts is attached hereto as Exhibit 6.

VII. CHAIN OF CUSTODY AND INTEGRITY OF EVIDENCE

19. The chain of custody and evidence integrity procedures employed by Pinnacle in this engagement were as follows. All CRH-issued devices were collected by CRH's IT Department on or about February 10, 2025, and placed in tamper-evident evidence bags with unique identification numbers. The devices were stored in a locked, access-controlled server room at CRH's corporate headquarters located at 2200 Elliott Avenue West, Suite 3400, Seattle, Washington 98119. Access to the stored devices was limited to designated CRH IT personnel and was logged. On February 21, 2025 — the day after Pinnacle's engagement — the devices were transferred to Pinnacle Forensics via Dunmore Solutions secure courier service, with a documented chain of custody form accompanying the shipment. Pinnacle received the shipment at its Silver Spring, Maryland facility on February 22, 2025, verified the tamper-evident seals, and logged each device into Pinnacle's secure evidence vault.

Forensic images of each device were created between February 22 and February 25, 2025, using Westvale Health IT T35689iu forensic write-blocking hardware connected between the source media and the imaging workstation to ensure that no data was written to or altered on the original evidence media during the imaging process. Forensic images were captured in Penrose Technologies Evidence File (.E01) format using Stonefield Software (Version 23.4). Upon completion of each forensic image, cryptographic hash values were automatically generated by the imaging software — specifically, both MD5 and SHA-256 hash values — and these hash values were compared against hash values independently calculated from the original source media. In all cases, the hash values matched, confirming bit-for-bit accuracy of each forensic image. The original devices remain in Pinnacle's secure evidence vault. All forensic analysis described in this declaration was conducted on the verified forensic images, not on the original evidence media.

20. With respect to CRH's enterprise log data, CRH's IT Department, acting upon instruction from Calderwood & Harkness LLP pursuant to the litigation hold notice issued on February 19, 2025, preserved all relevant enterprise audit logs. The preserved logs include: Aldermere Systems audit logs for the period October 1, 2024 through February 10, 2025; Pinnacle Health IT event monitoring logs for the same period; Aldermere Services Inc. sign-in and activity logs for the eight Rathore Group accounts; and Strathmore Data Systems message tracking and mailbox audit logs for the same accounts. These logs were exported by CRH IT in their native formats (CSV, JSON, and XML, as applicable by platform) with all associated metadata intact and were provided to Pinnacle electronically via a secure file transfer on February 23, 2025. Pinnacle has verified the integrity of the log data through internal consistency checks, including verification of chronological sequencing, cross-referencing of timestamps and event identifiers across multiple log sources, and confirmation that no gaps or anomalies suggestive of log manipulation or incompleteness were present in the data.

VIII. OPINIONS AND CONCLUSIONS

21. Based on the totality of the forensic evidence described in this declaration, including the analysis of 16 CRH-issued devices, enterprise audit logs from four distinct CRH systems, and the patterns of data transfer, deletion, and post-resignation access activity identified through that analysis, it is my professional opinion, to a reasonable degree of scientific certainty, that the data exfiltration undertaken by the members of the Rathore Group was deliberate, systematic, and coordinated. I base this opinion on the following factors:

(a) Timing: The exfiltration activity began abruptly on January 10, 2025, with no comparable bulk download or transfer activity identified in the preceding three months of the analysis period. The commencement of exfiltration activity aligns closely with events that I have been informed relate to the Rathore Group's recruitment by Verdana Commerce Group. The escalation in activity during January 13–24, 2025, and the peak activity during January 27 – February 3, 2025, correspond to the periods during which, I am informed, the Rathore Group was finalizing the terms of their departure and signing offer letters with Verdana. The cessation of activity on February 4, 2025, three days before the simultaneous resignations, is consistent with a planned conclusion of the exfiltration effort in advance of departure.

(b) Volume and Breadth: The volume of exfiltrated data — 14,327 files totaling approximately 2.8 GB — and the breadth of the exfiltration — spanning CRH's Aldermere Systems, Pinnacle Health IT, and email systems — are inconsistent with routine work activity. In my experience conducting forensic analyses in comparable corporate environments, routine work activity generates a substantially different pattern: smaller volumes of file access concentrated in the employee's immediate work areas, with no systematic transfers to personal cloud storage accounts.

(c) Targeting: The exfiltrated files were heavily concentrated in the most sensitive and strategically valuable categories of CRH data, including Project Ridgeline materials, vendor negotiation term sheets, private-label cost models, seasonal buying algorithms, and customer segmentation data. Over sixty-two percent (62%) of the exfiltrated files bore CRH confidentiality markings. This targeting is inconsistent with random or incidental file access and instead reflects a purposeful selection of CRH's most competitively valuable information.

(d) Coordination: The exfiltration activity involved all eight members of the Rathore Group acting across the same timeframe, using similar methods (download from Aldermere Systems/Pinnacle Health IT to local laptop, then upload to personal cloud storage), and targeting complementary categories of data corresponding to each employee's area of responsibility within the merchandising division. This pattern is consistent with a coordinated effort in which each member of the group was responsible for extracting data from his or her respective area of expertise.

(e) Concealment: The evidence of browser history deletion, cloud sync client removal, Recycle Bin emptying, file-wiping utility usage, and email deletion on multiple CRH-issued devices, all occurring on February 5–6, 2025 immediately before the devices were returned, demonstrates awareness that the data transfer activity was unauthorized and an effort to hide it. The after-hours and weekend timing of much of the exfiltration activity further supports an inference of deliberate concealment.

22. The forensic evidence establishes that the exfiltrated data has been transferred to personal cloud storage accounts and potentially to personal USB storage devices that remain entirely outside of CRH's control. At the time of this declaration, there is no evidence that the exfiltrated data has been returned to CRH or destroyed by any member of the Rathore Group. To the contrary, the post-resignation access attempts described in Section VI above suggest that at least some members of the Rathore Group sought to obtain additional CRH data even after their resignations. Absent judicial intervention requiring the identification, return, and verified destruction of all copies of the exfiltrated data — including copies residing in personal cloud storage accounts, on personal USB devices, and on any systems of Verdana Commerce Group, Inc. to which the data may have been further disseminated — there is, in my professional opinion, a substantial and ongoing risk that CRH's proprietary and confidential information, including Project Ridgeline materials, vendor negotiation term sheets, private-label cost models, seasonal buying algorithms, and customer segmentation data, could be disseminated, utilized, or exploited to the competitive advantage of Verdana Commerce Group, Inc. and to the irreparable detriment of CRH.

23. Based on the findings of this forensic examination, I respectfully recommend that a comprehensive forensic audit be conducted of the following:

(a) The personal devices (including personal laptops, desktop computers, tablets, and mobile phones) of each member of the Rathore Group;

(b) The personal cloud storage accounts (including Hollowell Health IT, Larkspur Technologies, personal Cobalt Ridge Systems, and any other cloud storage services) of each member of the Rathore Group;

(c) The personal USB storage devices and external media identified in Section V above (the Harborline Technologies flash drive, Beaumont Solutions SSD, Adriatic Health IT flash drive, and Strathmore Systems drive), as well as any other personal storage media to which CRH data may have been copied;

(d) Any Verdana Commerce Group, Inc. enterprise systems, including email servers, document management systems, shared drives, and cloud storage environments, to which the exfiltrated CRH data may have been further transferred or uploaded by any member of the Rathore Group following the commencement of their employment with Verdana; and

(e) Any other devices, accounts, or systems identified through the above audit as having received or stored copies of the exfiltrated data.

Such an audit is necessary, in my professional judgment, to identify all copies of CRH's proprietary information and to ensure their complete return or destruction under conditions that can be forensically verified. I note that without access to the personal devices, cloud accounts, and Verdana systems described above, it is impossible to determine the full scope of dissemination of CRH's data or to confirm that no copies remain in unauthorized hands.

IX. DOCUMENTS AND MATERIALS REVIEWED

24. In forming the opinions and conclusions set forth in this declaration, I reviewed the following documents and materials:

(a) Forensic images of eight (8) CRH-issued laptop computers (Kestrel Solutions series) assigned to the members of the Rathore Group;

(b) Forensic images of eight (8) CRH-issued mobile phones (Brightwater Systems) assigned to the members of the Rathore Group;

(d) CRH Pinnacle Health IT event monitoring logs for the period October 1, 2024 through February 10, 2025;

(e) Aldermere Services Inc. sign-in and activity logs for the eight departing employee accounts for the period October 1, 2024 through February 10, 2025;

(f) CRH email server logs (Strathmore Data Systems message tracking logs and mailbox audit logs) for the eight departing employee accounts for the period October 1, 2024 through February 10, 2025;

(g) CRH Information Security Policy (revised effective January 1, 2024) and associated Data Classification Guidelines;

(h) Employment Agreements, including restrictive covenant provisions (confidentiality, non-competition, and non-solicitation clauses), for all eight members of the Rathore Group — reviewed for context regarding the scope of each employee's confidentiality obligations and to understand the information to which each employee had authorized access during employment; and

(i) CRH IT Department records regarding device assignment (asset inventory records), credential management (account provisioning records), and access permissions (role-based access control configurations) for each member of the Rathore Group.

X. EXHIBITS REFERENCED

25. The following exhibits are attached to and incorporated by reference in this declaration:

Exhibit 1: Curriculum Vitae of Dr. Rajiv Anand, setting forth educational background, professional certifications, employment history, publications, and expert testimony history.

Exhibit 2: Summary Table of Exfiltrated Files by Employee, Date, Source System, and File Category — a tabular compilation documenting the 14,327 exfiltrated files across all eight members of the Rathore Group, organized by employee, transfer date, originating CRH system (Aldermere Systems, Pinnacle Health IT, or email), and content category.

Exhibit 3: Timeline Chart of Exfiltration Activity (January 10 – February 4, 2025) — a graphical depiction of daily file transfer volumes, annotated with key events in the timeline as identified by counsel, including the January 6, 2025 dinner meeting, the encrypted messaging period, the offer letter execution period, and the resignation date.

Exhibit 4: Representative Samples of Exfiltrated File Names and Metadata Showing Confidentiality Markings — illustrative examples of exfiltrated file names, file paths, creation/modification dates, and document-level confidentiality markings, redacted as necessary to protect trade secret content.

Exhibit 5: USB Connection Log Extracts from CRH-Issued Laptops — extracts from Windows Registry and Windows Event Log entries documenting the connection of personal USB storage devices to CRH-issued laptops by members of the Rathore Group during the exfiltration period, including device serial numbers, connection timestamps, and associated file copy artifacts.

Exhibit 6: Post-Resignation Access Attempt Log (February 7–10, 2025) — extracts from Aldermere Services Inc. sign-in logs and Aldermere Systems/Pinnacle Health IT access logs documenting post-resignation authentication attempts and access events by members of the Rathore Group, including timestamps, user identifiers, source IP addresses, and access outcomes.

VERIFICATION

I declare under penalty of perjury under the laws of the State of Delaware and the United States of America that the foregoing is true and correct. This declaration is based on my personal knowledge and professional expertise, except where otherwise indicated, and I am prepared to testify to the matters stated herein.

Executed at Silver Spring, Maryland, on March 5, 2025.

________________________________________

Dr. Rajiv Anand Engagement Lead, Digital Forensics Division Pinnacle Forensics LLC 8700 Georgia Avenue, Suite 300 Silver Spring, MD 20910

Prepared and submitted by counsel for Plaintiff Cascade Retail Holdings Inc.:

CALDERWOOD & HARKNESS LLP

Bernard Crawford (Del. Bar No. 4587) Renata Vasquez (Del. Bar No. 5213) James Underwood (Del. Bar No. 6841) Devon Archer (Del. Bar No. 7102)

1301 K Street NW, Suite 1200 Washington, DC 20005 Telephone: (202) 555-7400 Facsimile: (202) 555-7401

Attorneys for Plaintiff Cascade Retail Holdings Inc.

CASCADE RETAIL HOLDINGS INC.,

Plaintiff,

PRIYA RATHORE, DEREK LINDEN, SONIA KACZMAREK, AMARA OSEI, BRENT HALVORSEN, LUCIA FERNANDEZ-GILL, NATHAN TSAO, KIRA JOHANSSON, and VERDANA COMMERCE GROUP, INC.,

Defendants.

Employee	Former Title	Files Transferred	Data Volume (MB)	Primary Destination
Priya Rathore	SVP, Merchandising	4,218	892	Personal Hollowell Health IT
Derek Linden	VP, Hardlines Merchandising	2,341	467	Personal Larkspur Technologies
Sonia Kaczmarek	VP, Softlines Merchandising	2,114	398	Personal Hollowell Health IT
Amara Osei	Director, Private Label Strategy	1,587	312	Personal Larkspur Technologies
Brent Halvorsen	Director, Seasonal Planning & Analytics	1,432	289	Personal Hollowell Health IT
Lucia Fernandez-Gill	Director, Vendor Relations (Domestic)	1,196	231	Personal Cobalt Ridge Systems
Nathan Tsao	Senior Manager, eCommerce Merchandising	847	142	Personal Hollowell Health IT
Kira Johansson	Senior Manager, Category Analytics	592	117	Personal Larkspur Technologies
TOTAL	14,327	2,848 (~2.8 GB)

IN THE COURT OF CHANCERY OF THE STATE OF DELAWARE
DECLARATION OF DR. RAJIV ANAND IN SUPPORT OF PLAINTIFF'S MOTION FOR TEMPORARY RESTRAINING ORDER AND PRELIMINARY INJUNCTION
I, Dr. Rajiv Anand, hereby declare under penalty of perjury pursuant to 10 Del. C. § 3927 as follows:
This declaration is submitted in support of Plaintiff Cascade Retail Holdings Inc.'s ("CRH" or "Plaintiff") Motion for Temporary Restraining Order and Preliminary Injunction. I make this declaration based on my personal knowledge and professional expertise in digital forensics and data exfiltration analysis, except where otherwise indicated. Where statements are made on information and belief, I identify the basis for such belief. I am competent to testify to the matters stated herein, and if called as a witness, could and would testify competently thereto.
I. QUALIFICATIONS AND BACKGROUND OF DECLARANT
1. My name is Dr. Rajiv Anand. I am the Engagement Lead of the Digital Forensics Division at Pinnacle Forensics LLC ("Pinnacle"), a nationally recognized digital forensics and electronic discovery consulting firm. My business address is 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910. I have held my current position at Pinnacle since 2018 and have been employed by Pinnacle in various capacities since 2014.
2. I hold a Doctor of Philosophy (Ph.D.) in Computer Science, with a specialization in digital forensics and information security, from the University of Maryland, College Park, which I received in 2009. I also hold a Master of Science in Computer Engineering from Virginia Polytechnic Institute and State University (Virginia Tech), conferred in 2005, and a Bachelor of Science in Electrical Engineering from the Georgia Institute of Technology, conferred in 2003. I hold the following professional certifications relevant to the forensic work described in this declaration: Certified Computer Examiner (CCE), issued by the International Society of Forensic Computer Examiners; Penrose Technologies Certified Examiner (EnCE), issued by Thackeray Solutions; GIAC Certified Forensic Examiner (GCFE), issued by the SANS Institute; and Certified Information Systems Security Professional (CISSP), issued by the International Information Systems Security Certification Consortium, or (ISC)². I have maintained all of these certifications in active status through continuing professional education. Over the course of my career, I have accumulated more than fifteen (15) years of experience in the field of digital forensics, including extensive work in the areas of corporate data exfiltration investigations, trade secret misappropriation matters, and litigation support relating to the enforcement of restrictive covenants such as non-competition and non-solicitation agreements.
3. Throughout my career, I have been retained as a forensic expert in approximately eighty-five (85) litigation matters in federal and state courts across the United States, as well as in arbitration proceedings. I have testified as a qualified expert witness on approximately thirty (30) occasions in federal and state courts, including on two prior occasions in the Delaware Court of Chancery. My expert testimony has addressed subjects including forensic imaging methodology, digital chain of custody, analysis of file system metadata and audit logs, identification of data exfiltration patterns, and the reconstruction of deleted digital evidence. I have published peer-reviewed articles on topics related to digital forensics in the Journal of Digital Forensics, Security and Law, the International Journal of Electronic Security and Digital Forensics, and the Digital Investigation journal. I am a member of the American Academy of Forensic Sciences (Digital and Multimedia Sciences Section), the High Technology Crime Investigation Association, and the International Association of Computer Investigative Specialists. A true and correct copy of my curriculum vitae, which sets forth my educational background, professional certifications, publications, and expert testimony history in further detail, is attached hereto as Exhibit 1.
4. I was retained by Calderwood & Harkness LLP, counsel for Plaintiff Cascade Retail Holdings Inc., on February 20, 2025. The scope of my engagement encompasses the following: (a) the forensic imaging and analysis of CRH-issued electronic devices returned by the eight departing employees identified in this litigation (collectively referred to herein as the "Rathore Group"); (b) the analysis of cloud access logs and data transfer records from CRH's enterprise systems, including CRH's Sundial Systems, Pinnacle Health IT, Strathmore Data Systems, and Aldermere Services Inc. environments; and (c) the identification, characterization, and quantification of any data exfiltration activities undertaken by members of the Rathore Group using CRH's devices and enterprise systems. In conducting this engagement, I have overseen a team of four forensic analysts at Pinnacle, each of whom holds relevant professional certifications and has significant experience in corporate data exfiltration investigations. I have personally directed all phases of the forensic examination, reviewed the work product of my team, and verified the findings presented in this declaration.
II. SCOPE OF FORENSIC EXAMINATION
5. On February 21, 2025, Pinnacle received and took custody of CRH-issued electronic devices that had been returned by each of the eight departing employees upon or shortly after their simultaneous resignations on February 7, 2025. These devices had been collected by CRH's Information Technology Department on or about February 10, 2025, and stored in a secure, access-controlled location at CRH's corporate headquarters pending transfer to Pinnacle. The devices received by Pinnacle included the following:
(a) Eight (8) CRH-issued laptop computers (Kestrel Solutions series), one assigned to each member of the Rathore Group;
(b) Eight (8) CRH-issued mobile phones (Brightwater Systems), one assigned to each member of the Rathore Group; and
(c) No external storage media were returned by any member of the Rathore Group. CRH's IT Department confirmed that no USB drives, portable hard drives, or other external storage devices were included among the returned materials, despite CRH's device return policy requiring the return of all CRH-issued or CRH-associated storage media.
Each device was identified by employee assignment, device type, serial number, and CRH asset tag number. A summary table identifying each device, its assigned user, serial number, and CRH asset tag is set forth in Exhibit 2 to this declaration. Pinnacle created forensically sound, bit-for-bit images of each device upon receipt, as described further in Section VII below.
6. In addition to the physical devices, Pinnacle's examination encompassed the following CRH enterprise systems and cloud environments:
(a) CRH's Sundial Systems Environment: CRH utilizes Sundial Systems as its enterprise document management system. The merchandising division, of which all eight members of the Rathore Group were part, maintained extensive document libraries on containing strategic planning documents, vendor negotiation materials, financial models, analytics reports, and other confidential business records. Pinnacle reviewed Aldermere Systems audit logs capturing file access, download, modification, and sharing activity by the Rathore Group members.
(b) CRH's Pinnacle Health IT Environment: CRH utilizes the Pinnacle Health IT platform as its customer relationship management and vendor management system. The Pinnacle Health IT instance contains vendor contact information, pricing data, rebate structures, customer segmentation data, and related business intelligence. Pinnacle reviewed Pinnacle Health IT event monitoring logs capturing data export activity, report generation, and login events attributable to Rathore Group members.
(c) CRH's Cloud Access and Activity Logging Infrastructure: Pinnacle reviewed Aldermere Services Inc. ("Azure AD") sign-in logs, which record authentication events and session details for users accessing CRH's Ashgrove Software and Azure-hosted services. These logs include timestamp, user identity, IP address, device information, and access outcome (success or failure) for each sign-in event.
(d) CRH's Email System: CRH utilizes Cobalt Ridge Data Systems (Ridgeline Services Inc.) as its enterprise email and calendar platform. Pinnacle reviewed email server logs, including message tracking logs and mailbox audit logs, for the relevant Rathore Group accounts.
CRH's IT Department, under the direction of CRH's Chief Information Security Officer, provided Pinnacle with administrative-level access credentials and comprehensive audit log exports for each of the above systems covering the relevant time period. All log data was provided in native format with associated metadata intact.
7. Pinnacle conducted the forensic examination using industry-standard forensic imaging protocols and analysis methodologies, consistent with best practices recognized by the digital forensics community and applicable professional standards. The specific methodologies employed in this engagement included the following:
(a) Forensic Imaging: Bit-for-bit forensic images of all physical devices were created using Westvale Health IT forensic write-blockers (hardware-based) to prevent any alteration to the original evidence media during the imaging process. Forensic images were captured using Stonefield Software (Version 23.4) and verified through the generation and comparison of cryptographic hash values (both MD5 and SHA-256) for each image against the original media.
(b) Chain of Custody: A documented chain of custody was maintained for all physical devices and digital evidence from the point of receipt through the completion of analysis. Each item of evidence was assigned a unique Pinnacle case evidence number and logged in Pinnacle's secure evidence management system.
(c) Analysis Tools: Forensic analysis was conducted using Stonefield Software (Version 23.4), Camberwell Systems ("Ostrander Solutions") (Version 8.0), and Axiom Examine (Version 7.8), supplemented by custom scripts developed by Pinnacle for targeted log analysis and correlation.
(d) Evidence Reviewed: The analysis encompassed file system metadata (including NTFS Master File Table records, file creation/modification/access timestamps, and file path data); web browser histories and cached data (across Chrome, Edge, and Firefox browsers); USB connection logs (Windows Registry entries and Windows Event Logs recording USB device connection and disconnection events); cloud sync client logs (Cobalt Ridge Systems, Hollowell Health IT, and Larkspur Technologies desktop client activity logs); email headers and message metadata; and enterprise-side audit trails as described above.
(e) Analysis Period: The primary analysis period focused on the timeframe from October 1, 2024 through February 10, 2025. This period was selected to capture activity beginning shortly after the completion of CRH's strategic initiative known internally as "Project Ridgeline" (completed in October 2024) through the date on which CRH disabled the Rathore Group members' enterprise credentials following their resignations. Certain analyses, including post-resignation access attempts, extended through February 10, 2025.
III. SUMMARY OF KEY FINDINGS — DATA EXFILTRATION
8. Based on the forensic analysis described above, Pinnacle identified significant and sustained unauthorized data transfer activity by members of the Rathore Group during the period from January 10, 2025 through February 4, 2025 — a twenty-six (26) day window. During this period, members of the Rathore Group collectively transferred a total of 14,327 files from CRH's enterprise systems (principally Aldermere Systems and Pinnacle Health IT) to personal cloud storage accounts that were not authorized, managed, or controlled by CRH. The total data volume of these transfers was approximately 2.8 gigabytes (GB). The transfers were made to personal (non-CRH) cloud storage services, including personal Hollowell Health IT accounts, personal Larkspur Technologies accounts, and, in certain instances, personal Severin Services Inc. accounts that were distinct from the employees' CRH-managed enterprise Cobalt Ridge Systems accounts. These personal cloud storage destinations were identified through analysis of browser history artifacts, cloud sync client configuration files recovered from the CRH-issued laptops, and correlation with CRH's enterprise audit logs.
9. The timeline of the exfiltration activity identified by Pinnacle is as follows:
(a) January 10, 2025 — Onset of Exfiltration Activity: The earliest identified unauthorized data transfer occurred on January 10, 2025. I have been informed by counsel that this date falls four days after a dinner meeting that took place on January 6, 2025, at a restaurant in New York City, between Verdana Commerce Group CEO Warren Dietrich, Greystone Capital Partners Managing Partner Elliot Westbrook, and Defendant Priya Rathore. While I express no opinion regarding the significance of that meeting, I note that no comparable data transfer activity was identified in the analysis period prior to January 10, 2025 — that is, the forensic analysis of the October 1, 2024 through January 9, 2025 period revealed no pattern of bulk downloads or transfers to personal cloud storage accounts by any member of the Rathore Group.
(b) January 13–24, 2025 — Escalation Phase: Data exfiltration activity increased substantially during the period from January 13 through January 24, 2025. During this twelve-day window, approximately 5,860 files were transferred to personal cloud storage accounts by members of the Rathore Group, representing approximately 41% of the total exfiltrated file count. I have been informed by counsel that this period coincides with encrypted messaging exchanges among members of the Rathore Group regarding their coordinated departure from CRH, though the content of those messages is outside the scope of my forensic analysis of CRH's enterprise systems.
(c) January 27 – February 3, 2025 — Peak Activity Phase: The highest concentration of data transfer activity occurred during the period from January 27 through February 3, 2025. During this eight-day window, approximately 6,412 files were transferred, representing approximately 45% of the total exfiltrated file count. The daily volume of transferred files during this period exceeded 800 files per day on multiple occasions, with a single-day peak of 1,247 files on January 29, 2025. I have been informed by counsel that this period coincides with the execution of employment offer letters between Verdana Commerce Group and the individual members of the Rathore Group.
(d) February 4, 2025 — Final Exfiltration Activity: The last identified unauthorized data transfer occurred on February 4, 2025, three days before the simultaneous resignations of all eight members of the Rathore Group on February 7, 2025. On this date, a final batch of approximately 418 files was transferred, primarily by Defendants Rathore and Halvorsen.
(e) Pattern of After-Hours and Weekend Activity: A significant proportion of the identified data transfer activity — approximately sixty-two percent (62%) by file count — occurred outside of normal business hours (defined as 8:00 AM to 6:00 PM Pacific Time, Monday through Friday). Specifically, substantial download and transfer activity was identified during evening hours (after 8:00 PM PT), early morning hours (before 6:00 AM PT), and on weekends. This pattern of after-hours and weekend activity is, in my professional opinion, consistent with deliberate efforts to avoid detection during periods of lower network monitoring and reduced colleague presence.
A detailed timeline chart depicting daily exfiltration volumes and the correlation with key events identified by counsel is attached hereto as Exhibit 3.
10. The following table sets forth a breakdown of the exfiltration activity attributable to each individual member of the Rathore Group, based on Pinnacle's forensic analysis:
As reflected above, Defendant Priya Rathore was the largest individual contributor, accounting for approximately 29.4% of the total exfiltrated files and approximately 31.3% of the total data volume. A detailed summary table listing the exfiltrated files by employee, date, source system, and file category is attached hereto as Exhibit 2.
IV. NATURE AND CLASSIFICATION OF EXFILTRATED FILES
11. Pinnacle conducted a content-level review and classification of the 14,327 exfiltrated files. Based on that analysis, the files were classified into the following categories:
(a) Project Ridgeline Materials (approximately 3,847 files): This category comprises presentations, strategic planning documents, financial projections, market analyses, and supporting analytical workbooks relating to CRH's five-year category expansion roadmap completed in October 2024, known internally as "Project Ridgeline." Based on my review of these materials and the information provided to me regarding CRH's business operations, these materials contain proprietary vendor negotiation strategies detailing CRH's approach to securing favorable terms with key suppliers; private-label margin targets reflecting CRH's internal profitability benchmarks and pricing philosophy for its owned brands; and ecommerce assortment algorithms describing CRH's proprietary methodology for selecting and optimizing product assortments across its digital channels. Project Ridgeline materials were accessed and downloaded by all eight members of the Rathore Group, with the largest concentrations attributable to Defendants Rathore, Linden, and Kaczmarek.
(b) Vendor Negotiation Term Sheets (approximately 2,631 files): This category comprises confidential term sheets, memoranda of understanding, and related negotiation correspondence reflecting CRH's negotiated pricing, volume-based rebate structures, promotional allowance terms, and exclusivity arrangements with key vendors across multiple product categories, including home goods, seasonal décor, hardlines, and softlines. These materials were primarily downloaded by Defendants Linden, Kaczmarek, and Fernandez-Gill.
(c) Private-Label Cost Models (approximately 2,208 files): This category comprises proprietary financial models, cost-of-goods analyses, margin waterfall spreadsheets, and pricing strategy documents relating to CRH's private-label product lines, including the "Veltrano Home," "Seasoncraft," and "ArcticThread" brands. These materials detail raw material sourcing costs, manufacturing costs, logistics costs, target retail prices, and resulting margin structures at a granular product-SKU level. These materials were primarily downloaded by Defendants Osei and Rathore.
(d) Customer Segmentation Data (approximately 2,146 files): This category comprises detailed customer analytics reports, segmentation models, demographic and psychographic profiles, purchase behavior analyses, and related datasets used by CRH's merchandising division to inform product assortment decisions, promotional targeting strategies, and channel allocation decisions. These materials were primarily downloaded by Defendants Halvorsen, Tsao, and Johansson.
(e) Seasonal Buying Algorithms (approximately 1,723 files): This category comprises proprietary algorithms, analytical frameworks, demand forecasting models, and related technical documentation used by CRH for seasonal merchandise planning, open-to-buy management, and inventory optimization across CRH's retail and ecommerce channels. These materials reflect years of development and refinement by CRH's analytics teams. These materials were primarily downloaded by Defendants Halvorsen and Johansson.
(f) Other Confidential Business Documents (approximately 1,772 files): This category comprises internal memoranda, competitive intelligence analyses, organizational charts, vendor contact databases (including key contact names, email addresses, phone numbers, and relationship notes), meeting minutes, budget documents, and related operational documents of CRH's merchandising division. These materials were downloaded by various members of the Rathore Group.
12. A significant number of the exfiltrated files bore CRH confidentiality markings embedded in the documents themselves. Specifically, Pinnacle's content analysis identified the following markings appearing on exfiltrated files:
(a) "CRH CONFIDENTIAL" — appearing on approximately 8,941 of the 14,327 exfiltrated files (approximately 62.4%);
(b) "CRH — INTERNAL USE ONLY" — appearing on approximately 3,287 of the exfiltrated files (approximately 22.9%);
(c) "PROJECT RIDGELINE — RESTRICTED DISTRIBUTION" — appearing on approximately 2,614 of the exfiltrated files (approximately 18.2%), all of which were a subset of the Project Ridgeline materials category described above; and
(d) "CRH HIGHLY CONFIDENTIAL — EXECUTIVE ACCESS ONLY" — appearing on approximately 1,106 of the exfiltrated files (approximately 7.7%), representing materials designated at the highest tier under CRH's information classification policies.
I have been provided with and have reviewed CRH's Information Security Policy (revised effective January 1, 2024) and its associated Data Classification Guidelines. Based on that review, I understand that materials bearing the "CRH HIGHLY CONFIDENTIAL — EXECUTIVE ACCESS ONLY" and "PROJECT RIDGELINE — RESTRICTED DISTRIBUTION" designations are subject to the most restrictive handling requirements under CRH's policies, including prohibitions on transmission to external parties, storage on personal devices, and transfer to non-CRH cloud environments. The Rathore Group's transfer of these materials to personal cloud storage accounts was, to my understanding, directly contrary to these policies. Representative samples of exfiltrated file names and metadata showing these confidentiality markings are attached hereto as Exhibit 4 (redacted as necessary to protect trade secret content).
13. The categories of exfiltrated data described above correspond directly to what I understand to be CRH's core competitive advantages in the omnichannel retail space, particularly in home goods, seasonal décor, and private-label apparel. I have been informed by counsel that Verdana Commerce Group, Inc. ("Verdana") has publicly announced expansion plans in these same product categories and that Verdana directly competes with CRH in twenty-eight (28) overlapping product categories. While I express no legal opinion regarding the competitive implications of the data exfiltration, I note as a factual matter that possession of these materials — including CRH's proprietary vendor pricing and rebate terms, private-label cost structures and margin targets, seasonal demand forecasting algorithms, and customer segmentation models — by any direct competitor would provide that competitor with a significant and detailed window into CRH's strategic positioning, pricing philosophy, cost structure, and analytical capabilities, information that would ordinarily require years of independent development and substantial capital investment to replicate.
V. METHODS OF EXFILTRATION
14. Aldermere Systems Downloads to Personal Cloud Storage. Cloud access logs from CRH's Aldermere Systems environment, corroborated by browser history artifacts and cloud sync client logs recovered from the CRH-issued laptops, reveal the following pattern of activity. Members of the Rathore Group accessed Aldermere Systems document libraries using their CRH credentials through web browser sessions (primarily Ashford Services Inc. and Penrose Systems) and, in some cases, through the Aldermere Systems desktop sync client integrated with their CRH-managed Larkspur Health IT accounts. Files were downloaded from Aldermere Systems to the local hard drives of the CRH-issued laptops. Subsequently, these files were uploaded — either manually through web browser uploads or automatically through desktop sync clients — to personal cloud storage accounts not associated with or managed by CRH. The specific personal cloud services identified as exfiltration destinations include: personal Hollowell Health IT accounts (identified through browser history artifacts, Hollowell Health IT desktop client configuration files, and authenticated session cookies); personal Larkspur Technologies accounts (identified through Larkspur Technologies desktop client installation artifacts, configuration databases, and file sync logs); and personal Severin Services Inc. accounts distinct from the employees' CRH enterprise Cobalt Ridge Systems accounts (identified through Cobalt Ridge Systems client configuration files referencing personal Microsoft account credentials). In certain instances, Pinnacle identified that Rathore Group members created new personal cloud storage accounts during the exfiltration period specifically for the purpose of receiving the downloaded CRH files, as evidenced by account creation confirmation emails found in browser cache artifacts.
15. Pinnacle Health IT Data Exports. Pinnacle Health IT event monitoring logs provided by CRH reveal that certain members of the Rathore Group — specifically, Defendants Fernandez-Gill, Linden, and Osei — executed bulk data exports from CRH's Pinnacle Health IT instance during the January 10 – February 4, 2025 period. These exports were accomplished through Pinnacle Health IT's native data export and report export functionality. The exported data included vendor contact records (names, titles, email addresses, phone numbers, and relationship history notes for key vendor contacts); pricing data (negotiated unit prices, volume discount tiers, and promotional pricing terms by vendor and product category); and customer segmentation reports (aggregate customer demographic data, purchase frequency analyses, and segment-level profitability reports). Pinnacle Health IT event monitoring logs record these export events with timestamps, user identifiers, record counts, and data object types. The exported data was saved to local laptop storage and subsequently transferred to personal cloud storage accounts using the methods described in the preceding paragraph.
16. USB and External Media Activity. Forensic imaging and analysis of the eight CRH-issued laptops revealed USB connection logs — specifically, Windows Registry entries under HKEY\LOCAL\MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR and corresponding Windows Event Log entries (Event IDs 2003 and 2100) — indicating that personal USB storage devices were connected to CRH-issued laptops by multiple members of the Rathore Group during the January 10 – February 4, 2025 period. The USB devices identified through these artifacts include the following:
(a) A Harborline Technologies USB 3.0 flash drive (64 GB capacity), serial number 4C530001260817116292, connected to the laptop assigned to Defendant Rathore on January 14, January 22, and January 30, 2025;
(b) A Beaumont Solutions portable SSD (500 GB capacity), serial number S5NENG0R502378M, connected to the laptop assigned to Defendant Halvorsen on January 18 and January 29, 2025;
(c) A Adriatic Health IT USB 3.2 flash drive (128 GB capacity), serial number 60A44C41370CBF31, connected to the laptop assigned to Defendant Linden on January 20, January 26, and February 1, 2025; and
(d) A Strathmore Systems portable hard drive (1 TB capacity), serial number WX92A95JZE5E, connected to the laptop assigned to Defendant Tsao on January 23 and February 3, 2025.
File system artifacts — including Windows Shellbag entries, link (LNK) files, and Jump List data — confirm that file copy operations were performed to these USB devices during the connected sessions. The file paths recorded in these artifacts correspond to directories containing CRH documents previously downloaded from Aldermere Systems. Critically, none of these USB devices were among the materials returned by any member of the Rathore Group to CRH upon their resignation. This finding indicates that copies of CRH's confidential and proprietary data may exist on personal external storage media that have not been returned, accounted for, or made available for forensic examination. Extracts from the USB connection logs are attached hereto as Exhibit 5.
17. Deletion and Concealment Activity. Forensic analysis identified substantial evidence of deliberate deletion and concealment activity on multiple CRH-issued devices prior to their return on or about February 7, 2025. Specifically, Pinnacle identified the following:
(a) Browser History Deletion: On the laptops assigned to Defendants Rathore, Linden, Kaczmarek, and Halvorsen, browser history data (including download history) for the Ashford Services Inc. and Penrose Systems browsers had been manually cleared on or about February 5–6, 2025. The browser history databases reflected deletion timestamps consistent with manual clearing operations rather than automated cache management.
(b) Cloud Sync Client Removal: On the laptops assigned to Defendants Rathore, Osei, and Tsao, the Hollowell Health IT desktop sync client and/or Larkspur Technologies desktop sync client had been uninstalled on or about February 5–6, 2025. Residual uninstallation artifacts, including Windows Installer logs and Prefetch file entries, confirm the timing of these removals.
(c) Recycle Bin Emptying and Secure Deletion: On the laptops assigned to Defendants Rathore and Halvorsen, Pinnacle identified evidence that the Windows Recycle Bin had been emptied on February 6, 2025. Additionally, on Defendant Rathore's laptop, Pinnacle identified artifacts consistent with the use of a file-wiping utility (Brightmoor Health IT, Version 6.19) on February 6, 2025, indicating an attempt to securely delete files and overwrite their contents to prevent forensic recovery.
(d) Email Deletion: Mailbox audit logs for the CRH Exchange accounts of Defendants Rathore, Linden, and Kaczmarek show substantial email deletion activity on February 5–6, 2025, including the permanent deletion (bypassing the Deleted Items folder) of emails with attachments and emails relating to file sharing and cloud storage links.
Despite these deletion efforts, Pinnacle's forensic recovery techniques — including analysis of unallocated disk space, Volume Shadow Copies, Windows Event Logs, NTFS journal entries ($UsnJrnl), and Prefetch files — allowed Pinnacle to reconstruct the data transfer activity in substantial detail. Additionally, the enterprise-side audit trails maintained by CRH's Aldermere Systems, Pinnacle Health IT, and Azure AD systems were unaffected by the deletion activity on the individual laptops, as those logs are maintained at the server level and were not within the Rathore Group members' ability to modify or delete. The pattern of deletion activity described above is, in my professional opinion, consistent with deliberate and coordinated attempts to conceal the scope and nature of the data exfiltration prior to the return of CRH-issued devices.
VI. ANALYSIS OF CLOUD ACCESS LOGS POST-RESIGNATION
18. CRH's IT Department disabled enterprise credentials (Aldermere Services Inc. accounts) for all eight members of the Rathore Group upon notification of their resignations. I have been informed that the resignations were submitted on Friday, February 7, 2025, and that credential deactivation was completed on Monday, February 10, 2025 — the first business day following the resignations. During the intervening period — specifically, from the evening of February 7, 2025 through February 9, 2025 (a weekend period) — CRH's Aldermere Services Inc. sign-in logs and Aldermere Systems audit logs record multiple access attempts to CRH's enterprise systems using credentials belonging to members of the Rathore Group. The following access attempts were identified:
(a) On February 7, 2025, between 7:42 PM and 11:18 PM Pacific Time, seven (7) sign-in attempts were made to CRH's Aldermere Systems environment using the credentials of Defendant Rathore. Four of these attempts were successful, resulting in authenticated sessions during which additional Aldermere Systems document library browsing activity was recorded. The source IP addresses for these attempts (104.28.xx.xx range) resolved to a residential internet service provider in the Seattle metropolitan area and were not associated with CRH's corporate network or VPN infrastructure.
(b) On February 8, 2025, between 9:14 AM and 2:47 PM Pacific Time, four (4) sign-in attempts were made to CRH's Pinnacle Health IT environment using the credentials of Defendant Fernandez-Gill. Three of these attempts were successful. The source IP addresses (73.181.xx.xx range) resolved to a residential internet service provider in the Portland, Oregon area.
(c) On February 9, 2025, between 10:03 AM and 6:31 PM Pacific Time, eleven (11) sign-in attempts were made across CRH's Aldermere Systems and Pinnacle Health IT environments using the credentials of Defendants Rathore, Linden, and Halvorsen. Six of these attempts were successful. The source IP addresses for these attempts did not correspond to CRH's corporate network and resolved to residential internet service providers in the Seattle and Bellevue, Washington areas.
All access attempts ceased after credential deactivation on February 10, 2025. The post-resignation access attempts described above originated from IP addresses not associated with CRH's corporate network, strongly suggesting that these access events were initiated from personal devices or personal internet connections outside of CRH's premises. A log extract documenting these post-resignation access attempts is attached hereto as Exhibit 6.
VII. CHAIN OF CUSTODY AND INTEGRITY OF EVIDENCE
19. The chain of custody and evidence integrity procedures employed by Pinnacle in this engagement were as follows. All CRH-issued devices were collected by CRH's IT Department on or about February 10, 2025, and placed in tamper-evident evidence bags with unique identification numbers. The devices were stored in a locked, access-controlled server room at CRH's corporate headquarters located at 2200 Elliott Avenue West, Suite 3400, Seattle, Washington 98119. Access to the stored devices was limited to designated CRH IT personnel and was logged. On February 21, 2025 — the day after Pinnacle's engagement — the devices were transferred to Pinnacle Forensics via Dunmore Solutions secure courier service, with a documented chain of custody form accompanying the shipment. Pinnacle received the shipment at its Silver Spring, Maryland facility on February 22, 2025, verified the tamper-evident seals, and logged each device into Pinnacle's secure evidence vault.
Forensic images of each device were created between February 22 and February 25, 2025, using Westvale Health IT T35689iu forensic write-blocking hardware connected between the source media and the imaging workstation to ensure that no data was written to or altered on the original evidence media during the imaging process. Forensic images were captured in Penrose Technologies Evidence File (.E01) format using Stonefield Software (Version 23.4). Upon completion of each forensic image, cryptographic hash values were automatically generated by the imaging software — specifically, both MD5 and SHA-256 hash values — and these hash values were compared against hash values independently calculated from the original source media. In all cases, the hash values matched, confirming bit-for-bit accuracy of each forensic image. The original devices remain in Pinnacle's secure evidence vault. All forensic analysis described in this declaration was conducted on the verified forensic images, not on the original evidence media.
20. With respect to CRH's enterprise log data, CRH's IT Department, acting upon instruction from Calderwood & Harkness LLP pursuant to the litigation hold notice issued on February 19, 2025, preserved all relevant enterprise audit logs. The preserved logs include: Aldermere Systems audit logs for the period October 1, 2024 through February 10, 2025; Pinnacle Health IT event monitoring logs for the same period; Aldermere Services Inc. sign-in and activity logs for the eight Rathore Group accounts; and Strathmore Data Systems message tracking and mailbox audit logs for the same accounts. These logs were exported by CRH IT in their native formats (CSV, JSON, and XML, as applicable by platform) with all associated metadata intact and were provided to Pinnacle electronically via a secure file transfer on February 23, 2025. Pinnacle has verified the integrity of the log data through internal consistency checks, including verification of chronological sequencing, cross-referencing of timestamps and event identifiers across multiple log sources, and confirmation that no gaps or anomalies suggestive of log manipulation or incompleteness were present in the data.
VIII. OPINIONS AND CONCLUSIONS
21. Based on the totality of the forensic evidence described in this declaration, including the analysis of 16 CRH-issued devices, enterprise audit logs from four distinct CRH systems, and the patterns of data transfer, deletion, and post-resignation access activity identified through that analysis, it is my professional opinion, to a reasonable degree of scientific certainty, that the data exfiltration undertaken by the members of the Rathore Group was deliberate, systematic, and coordinated. I base this opinion on the following factors:
(a) Timing: The exfiltration activity began abruptly on January 10, 2025, with no comparable bulk download or transfer activity identified in the preceding three months of the analysis period. The commencement of exfiltration activity aligns closely with events that I have been informed relate to the Rathore Group's recruitment by Verdana Commerce Group. The escalation in activity during January 13–24, 2025, and the peak activity during January 27 – February 3, 2025, correspond to the periods during which, I am informed, the Rathore Group was finalizing the terms of their departure and signing offer letters with Verdana. The cessation of activity on February 4, 2025, three days before the simultaneous resignations, is consistent with a planned conclusion of the exfiltration effort in advance of departure.
(b) Volume and Breadth: The volume of exfiltrated data — 14,327 files totaling approximately 2.8 GB — and the breadth of the exfiltration — spanning CRH's Aldermere Systems, Pinnacle Health IT, and email systems — are inconsistent with routine work activity. In my experience conducting forensic analyses in comparable corporate environments, routine work activity generates a substantially different pattern: smaller volumes of file access concentrated in the employee's immediate work areas, with no systematic transfers to personal cloud storage accounts.
(c) Targeting: The exfiltrated files were heavily concentrated in the most sensitive and strategically valuable categories of CRH data, including Project Ridgeline materials, vendor negotiation term sheets, private-label cost models, seasonal buying algorithms, and customer segmentation data. Over sixty-two percent (62%) of the exfiltrated files bore CRH confidentiality markings. This targeting is inconsistent with random or incidental file access and instead reflects a purposeful selection of CRH's most competitively valuable information.
(d) Coordination: The exfiltration activity involved all eight members of the Rathore Group acting across the same timeframe, using similar methods (download from Aldermere Systems/Pinnacle Health IT to local laptop, then upload to personal cloud storage), and targeting complementary categories of data corresponding to each employee's area of responsibility within the merchandising division. This pattern is consistent with a coordinated effort in which each member of the group was responsible for extracting data from his or her respective area of expertise.
(e) Concealment: The evidence of browser history deletion, cloud sync client removal, Recycle Bin emptying, file-wiping utility usage, and email deletion on multiple CRH-issued devices, all occurring on February 5–6, 2025 immediately before the devices were returned, demonstrates awareness that the data transfer activity was unauthorized and an effort to hide it. The after-hours and weekend timing of much of the exfiltration activity further supports an inference of deliberate concealment.
22. The forensic evidence establishes that the exfiltrated data has been transferred to personal cloud storage accounts and potentially to personal USB storage devices that remain entirely outside of CRH's control. At the time of this declaration, there is no evidence that the exfiltrated data has been returned to CRH or destroyed by any member of the Rathore Group. To the contrary, the post-resignation access attempts described in Section VI above suggest that at least some members of the Rathore Group sought to obtain additional CRH data even after their resignations. Absent judicial intervention requiring the identification, return, and verified destruction of all copies of the exfiltrated data — including copies residing in personal cloud storage accounts, on personal USB devices, and on any systems of Verdana Commerce Group, Inc. to which the data may have been further disseminated — there is, in my professional opinion, a substantial and ongoing risk that CRH's proprietary and confidential information, including Project Ridgeline materials, vendor negotiation term sheets, private-label cost models, seasonal buying algorithms, and customer segmentation data, could be disseminated, utilized, or exploited to the competitive advantage of Verdana Commerce Group, Inc. and to the irreparable detriment of CRH.
23. Based on the findings of this forensic examination, I respectfully recommend that a comprehensive forensic audit be conducted of the following:
(a) The personal devices (including personal laptops, desktop computers, tablets, and mobile phones) of each member of the Rathore Group;
(b) The personal cloud storage accounts (including Hollowell Health IT, Larkspur Technologies, personal Cobalt Ridge Systems, and any other cloud storage services) of each member of the Rathore Group;
(c) The personal USB storage devices and external media identified in Section V above (the Harborline Technologies flash drive, Beaumont Solutions SSD, Adriatic Health IT flash drive, and Strathmore Systems drive), as well as any other personal storage media to which CRH data may have been copied;
(d) Any Verdana Commerce Group, Inc. enterprise systems, including email servers, document management systems, shared drives, and cloud storage environments, to which the exfiltrated CRH data may have been further transferred or uploaded by any member of the Rathore Group following the commencement of their employment with Verdana; and
(e) Any other devices, accounts, or systems identified through the above audit as having received or stored copies of the exfiltrated data.
Such an audit is necessary, in my professional judgment, to identify all copies of CRH's proprietary information and to ensure their complete return or destruction under conditions that can be forensically verified. I note that without access to the personal devices, cloud accounts, and Verdana systems described above, it is impossible to determine the full scope of dissemination of CRH's data or to confirm that no copies remain in unauthorized hands.
IX. DOCUMENTS AND MATERIALS REVIEWED
24. In forming the opinions and conclusions set forth in this declaration, I reviewed the following documents and materials:
(a) Forensic images of eight (8) CRH-issued laptop computers (Kestrel Solutions series) assigned to the members of the Rathore Group;
(b) Forensic images of eight (8) CRH-issued mobile phones (Brightwater Systems) assigned to the members of the Rathore Group;
(c) CRH Aldermere Systems audit logs for the period October 1, 2024 through February 10, 2025;
(d) CRH Pinnacle Health IT event monitoring logs for the period October 1, 2024 through February 10, 2025;
(e) Aldermere Services Inc. sign-in and activity logs for the eight departing employee accounts for the period October 1, 2024 through February 10, 2025;
(f) CRH email server logs (Strathmore Data Systems message tracking logs and mailbox audit logs) for the eight departing employee accounts for the period October 1, 2024 through February 10, 2025;
(g) CRH Information Security Policy (revised effective January 1, 2024) and associated Data Classification Guidelines;
(h) Employment Agreements, including restrictive covenant provisions (confidentiality, non-competition, and non-solicitation clauses), for all eight members of the Rathore Group — reviewed for context regarding the scope of each employee's confidentiality obligations and to understand the information to which each employee had authorized access during employment; and
(i) CRH IT Department records regarding device assignment (asset inventory records), credential management (account provisioning records), and access permissions (role-based access control configurations) for each member of the Rathore Group.
X. EXHIBITS REFERENCED
25. The following exhibits are attached to and incorporated by reference in this declaration:
Exhibit 1: Curriculum Vitae of Dr. Rajiv Anand, setting forth educational background, professional certifications, employment history, publications, and expert testimony history.
Exhibit 2: Summary Table of Exfiltrated Files by Employee, Date, Source System, and File Category — a tabular compilation documenting the 14,327 exfiltrated files across all eight members of the Rathore Group, organized by employee, transfer date, originating CRH system (Aldermere Systems, Pinnacle Health IT, or email), and content category.
Exhibit 3: Timeline Chart of Exfiltration Activity (January 10 – February 4, 2025) — a graphical depiction of daily file transfer volumes, annotated with key events in the timeline as identified by counsel, including the January 6, 2025 dinner meeting, the encrypted messaging period, the offer letter execution period, and the resignation date.
Exhibit 4: Representative Samples of Exfiltrated File Names and Metadata Showing Confidentiality Markings — illustrative examples of exfiltrated file names, file paths, creation/modification dates, and document-level confidentiality markings, redacted as necessary to protect trade secret content.
Exhibit 5: USB Connection Log Extracts from CRH-Issued Laptops — extracts from Windows Registry and Windows Event Log entries documenting the connection of personal USB storage devices to CRH-issued laptops by members of the Rathore Group during the exfiltration period, including device serial numbers, connection timestamps, and associated file copy artifacts.
Exhibit 6: Post-Resignation Access Attempt Log (February 7–10, 2025) — extracts from Aldermere Services Inc. sign-in logs and Aldermere Systems/Pinnacle Health IT access logs documenting post-resignation authentication attempts and access events by members of the Rathore Group, including timestamps, user identifiers, source IP addresses, and access outcomes.
VERIFICATION
I declare under penalty of perjury under the laws of the State of Delaware and the United States of America that the foregoing is true and correct. This declaration is based on my personal knowledge and professional expertise, except where otherwise indicated, and I am prepared to testify to the matters stated herein.
Executed at Silver Spring, Maryland, on March 5, 2025.
________________________________________
Dr. Rajiv Anand Engagement Lead, Digital Forensics Division Pinnacle Forensics LLC 8700 Georgia Avenue, Suite 300 Silver Spring, MD 20910
Prepared and submitted by counsel for Plaintiff Cascade Retail Holdings Inc.:
CALDERWOOD & HARKNESS LLP
Bernard Crawford (Del. Bar No. 4587) Renata Vasquez (Del. Bar No. 5213) James Underwood (Del. Bar No. 6841) Devon Archer (Del. Bar No. 7102)
1301 K Street NW, Suite 1200 Washington, DC 20005 Telephone: (202) 555-7400 Facsimile: (202) 555-7401
Attorneys for Plaintiff Cascade Retail Holdings Inc.
CASCADE RETAIL HOLDINGS INC.,
Plaintiff,
v. | C.A. No. 2025-0198-MTZ
PRIYA RATHORE, DEREK LINDEN, SONIA KACZMAREK, AMARA OSEI, BRENT HALVORSEN, LUCIA FERNANDEZ-GILL, NATHAN TSAO, KIRA JOHANSSON, and VERDANA COMMERCE GROUP, INC.,
Defendants.
Employee | Former Title | Files Transferred | Data Volume (MB) | Primary Destination
Priya Rathore | SVP, Merchandising | 4,218 | 892 | Personal Hollowell Health IT
Derek Linden | VP, Hardlines Merchandising | 2,341 | 467 | Personal Larkspur Technologies
Sonia Kaczmarek | VP, Softlines Merchandising | 2,114 | 398 | Personal Hollowell Health IT
Amara Osei | Director, Private Label Strategy | 1,587 | 312 | Personal Larkspur Technologies
Brent Halvorsen | Director, Seasonal Planning & Analytics | 1,432 | 289 | Personal Hollowell Health IT
Lucia Fernandez-Gill | Director, Vendor Relations (Domestic) | 1,196 | 231 | Personal Cobalt Ridge Systems
Nathan Tsao | Senior Manager, eCommerce Merchandising | 847 | 142 | Personal Hollowell Health IT
Kira Johansson | Senior Manager, Category Analytics | 592 | 117 | Personal Larkspur Technologies
TOTAL | 14,327 | 2,848 (~2.8 GB)