Preview
NICOLE PHILLIS (SBN 291266)
nicolephillis@dwt.com
DAVIS WRIGHT TREMAINE LLP
865 S. Figueroa St., Suite 2400
Los Angeles, California 90017-2566
Telephone: (213) 633-6800
Facsimile: (213) 633-6899
JEREMY MERKELSON (pro hac vice forthcoming)
jeremymerkelson@dwt.com
DAVIS WRIGHT TREMAINE LLP
1301 K Street NW, Suite 500 East
Washington, D.C. 20005
Telephone: (202) 973-4260
Facsimile: (202) 973-4472
Attorneys for Plaintiff TRACE3, LLC
SUPERIOR COURT OF THE STATE OF CALIFORNIA
COUNTY OF SANTA CLARA
TRACE3, LLC, a California limited liability Case No. 23CV415833
company; Assigned to Hon. Sunil R. Kulkarni
Plaintiff,
SYCOMP A TECHNOLOGY COMPANY, DECLARATION OF SERGIO D.
INC., a California corporation; TIMOTHY KOPELEV IN SUPPORT OF PLAINTIFF
CORDELL, an individual; LILIAN ELIAS, an TRACE3, LLC’S MOTION TO MODIFY
individual; GEOFFREY PETERSON, an TEMPORARY RESTRAINING ORDER
individual; DEVIN TOMCIK, an individual; AND ORDER AUTHORIZING
and DOES 1-10, inclusive, EXPEDITED DISCOVERY
Defendants. [Notice of Motion and Memorandum of Points
and Authorities; Declarations of Jeremy Morris
and Nicole S. Phillis; [Proposed] Order filed
concurrently]
Date: July 28, 2023
Time: 9:00 a.m.
Dept:
Action Filed: May 12, 2023
DECLARATION OF SERGIO D. KOPELEV
DECLARATION OF SERGIO D. KOPELEV
I, Sergio D. Kopelev, declare as follows:
1. I am over the age of eighteen and am not operating under any mental
disabilities. I have personal knowledge of the matter set forth herein and if called upon to
testify, I could and would competently testify as follows.
BACKGROUND & QUALIFICATIONS
2. I am currently employed as a Vice President with Stroz Friedberg, an Aon
company (“Stroz Friedberg”).
3. I have been involved in the field of Computer Forensics since 1997. Since that
10 time, I have received over 700 hours of specialized training and education in the forensic
11 examination of digital evidence and computer media. I have extensive experience in the
12 forensic examination of digital evidence and computer media and have performed or supervised
13 over 1,000 computer forensic examinations, including e-discovery work conducted in
14 connection with civil litigation, financial restatements and government investigations.
15 4. I routinely assist clients through the successful management of large-scale
16 electronic discovery and computer forensics projects. I am a frequent lecturer and writer on the
17 topic of computer forensics and electronic discovery, and have published articles in the Los
18 Angeles Daily Journal, the Nevada Lawyer, as well as the Law Enforcement Technology
19 magazine. I have also been interviewed on CNN, National Public Radio, and by the Los
20 Angeles Times as an industry expert in computer forensics, and have provided testimony and
21 offered expert reports in jurisdictions across the U.S.
22 5. Prior to joining Stroz Friedberg, I was a Senior Director at Consilio, LLC and
23 Huron Legal. Prior to that, I was a principal with LECG, as well as a senior manager, director
24 and regional practice leader with Deloitte and KPMG accounting firms. Prior to entering the
25 private sector, I worked for 8 years in law enforcement, culminating with the rank of sergeant
26 with the Bedford County, Virginia, Sheriff’s Department, where I organized and supervised a
27 multi-agency Internet crimes taskforce called “Operation Blue Ridge Thunder.”
28
2
DECLARATION OF SERGIO D. KOPELEV
6. I am a summa cum laude graduate of the University of Massachusetts (Boston)
with a Bachelor of Arts degree from the College of Public and Community Service, as well as
an Masters of Fine Arts degree from Hollins University. Additionally, I have previously
received the following professional computer forensics certifications: EnCase Certified
Examiner (EnCE), Certified PDA Examiner (CPDAE), Certified Forensic Computer Examiner
(CFCE), and Certified Electronic Evidence Collection Specialist (CEECS).
7. My hourly rate for this matter is $525 per hour.
8. My complete CV is attached as Exhibit 1 to Exhibit A.
RETENTION AND ASSIGNMENT
10 9. In late April 2023, Stroz Friedberg was retained by Davis Wright Tremaine,
11 LLP (“Counsel”) on behalf of its client, Trace3, LLC (“Trace3”), to provide digital forensic
12 consulting and technical services, including review of corporate-managed cloud accounts and
13 company-issued electronic devices, where possible, for Brian Bartel (“Bartel”), Brian Law
14 (“Law”), Dawn McCale (“McCale”), Devin Tomcik (“Tomcik”), Geoff Peterson (“Peterson”),
15 Jasen Paris (“Paris”), John Barnes (“Barnes”), Kelly Phipps (“Phipps”), Lilian Elias (“Elias”),
16 Tim Cordell (“Cordell”), and Tim Smith (“Smith”), collectively referred to as the “Users of
17 Interest.”
18 10. Counsel also requested that Stroz Friedberg forensically preserve and analyze
19 available audit logs from the corporate-managed instance of Box for evidence of downloading
20 or deletion of business-related documents by accounts associated with the Users of Interest.
21 Similar preservation and analysis efforts are currently underway for additional corporate-
22 managed cloud applications.
23 11. Counsel requested that Stroz Friedberg forensically preserve and analyze the
24 hard drives extracted from a company-issued laptops belonging to Geoff Peterson, Devin
25 Tomcik, Dawn McCale, Tim Cordell, and Lilian Elias for evidence of copying or spoliation of
26
27
28
Box, Inc. develops and maintains a cloud-based file sharing and collaboration platform for businesses.
3
DECLARATION OF SERGIO D. KOPELEV
business-related documents. Similar preservation and analysis efforts are currently underway
for additional company-issued devices and custodians.
12. Counsel requested that Stroz Friedberg forensically preserve and analyze
Universal Serial Bus (“USB”) devices belonging to Geoff Peterson and Dawn McCale for
evidence of copying or exfiltrating business-related documents. Similar preservation and
analysis efforts are currently underway for additional company-issued devices and custodians.
13. Following issuance of the TRO and the filing of declarations from Geoffrey
Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias in opposition to Trace3’s ex parte
application, Trace3 requested that I conduct additional forensic review based upon the
10 representations made in the Individual Defendants’ declarations. I reviewed the declarations of
11 Geoffrey Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias and conducted further
12 analysis to ascertain when and from which devices the admitted file deletion took place. I also
13 analyzed the evidence to determine whether Defendants have accounted for all apparent copies
14 of the Trace3 confidential and trade secret information in their possession, custody, and control.
15 14. Evidence items reviewed for purposes of this Declaration are shown in Exhibit
16 2 to Exhibit A.
17 OPINIONS AND FINDINGS
18 15. Attached as Exhibit A is a true and correct declaration of my findings.
19 I declare under penalty of perjury under the laws of the State of California that the
20 foregoing is true and correct.
21 Executed this 6th of July, 2023, at Henderson, Nevada.
22
23
Sergio D. Kopelev
24
25
26
27
28
4
DECLARATION OF SERGIO D. KOPELEV
EXHIBIT A
DECLARATION OF SERGIO D. KOPELEV
IN SUPPORT OF PLAINTIFF TRACE3, LLC’S
MOTION TO MODIFY TEMPORARY RESTRAINING ORDER
AND ORDER AUTHORIZING EXPEDITED DISCOVERY
2nd DECLARATION OF SERGIO D. KOPELEV
I, Sergio D. Kopelev, depose and say under penalty of perjury that:
1. I am over the age of eighteen and am not operating under any mental disabilities.
I have personal knowledge of the matter set forth herein and if called upon to testify, I could and
would competently testify as follows.
2. I have provided a Declaration to the Court in support of Trace3, LLC’s Ex Parte
Application for Temporary Restraining Order and OSC RE Preliminary Injunction, which described
by background and professional qualifications. I am incorporating Paragraphs 1-8 of that
declaration by reference as if they are fully stated herein.
RETENTION AND ASSIGNMENT
3. In late April 2023, Stroz Friedberg was retained by Davis Wright Tremaine, LLP
(“Counsel”) on behalf of its client, Trace3, LLC (“Trace3”), to provide digital forensic consulting
and technical services, including review of Trace3’s corporate-managed cloud accounts and
company-issued electronic devices, where possible, for Brian Bartel (“Bartel”), Brian Law (“Law”),
Dawn McCale (“McCale”), Devin Tomcik (“Tomcik”), Geoff Peterson (“Peterson”), Jasen Paris
(“Paris”), John Barnes (“Barnes”), Kelly Phipps (“Phipps”), Lilian Elias (“Elias”), Timothy Cordell
(“Cordell”), Tim Smith (“Smith”) and Stacy Thompson (“Thompson”), collectively referred to as
the “Users of Interest.”
4. Following issuance of the TRO and the filing of declarations from Geoffrey
Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias in opposition to Trace3’s ex parte
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
application, Trace3 requested that I conduct additional forensic analysis based upon the
representations made in the Individual Defendants’ declarations. I reviewed the declarations of
Geoffrey Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias and conducted further
forensic review to ascertain when and from which devices the stated file deletion took place. I
also analyzed the evidence to determine whether Defendants have accounted for all apparent
copies of the Trace3 confidential and trade secret information in their possession, custody, and
control.
5. In furtherance of the work previously performed, Stroz Friedberg forensically
preserved and analyzed the hard drive extracted from a company-issued laptop belonging to
Timothy Cordell, Stacy Thompson, and Devin Tomcik for evidence of Dropbox activity.
6. Stroz Friedberg, with consent from Stacy Thompson, forensically preserved and
analyzed the Dropbox account associated with the non-corporate email address
.”
7. Stroz Friedberg forensically preserved and analyzed the hard drive extracted from
a company-issued laptop belonging to Lilian Elias for evidence of deletion activity.
8. Evidence items analyzed for purposes of this Declaration are shown in Exhibit 1.
9. Stroz Friedberg also reviewed the Declarations of Geoffrey Peterson, Lilian Elias
and Devon Tomcik, and the two declarations of Timothy Cordell.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
SUMMARY OF FINDINGS
10. Stroz Friedberg analyzed available activity from the Dropbox account associated
with the non-corporate email address “ ” (“ES0038 ”) and
determined that five (5) files / documents (Table A below) appear to have been deleted on April
25, 2023, and were no longer accessible from the Dropbox account.
No. File Name
1 Cordell Backlog.xlsx
2 T3 - Cloud Spend January 16 2023_data.csv
3 ISRG Akash ESXi Refresh.xlsx
4 Cordell Master Customer - Vendor List 2022.xlsx
5 Cordell Vendor Numbers (1).xlsx
Table A – Five (5) files / documents deleted from the Dropbox account on April 25, 2023
11. Forensic examination of the Groupware laptop used by Timothy Cordell
(“ES0029”) revealed evidence consistent with files contained in a folder on this laptop syncing
with a cloud Dropbox account associated with the “ ” email
address. Forensic examination also revealed that five (5) files / documents with the same file
names as those deleted from the Dropbox account (¶10) were found on ES0029.
12. Forensic examination of ES0029 did not reveal any records, artifacts, or logs for
user activity after April 21, 2023. As such, it appears that ES0029 is not the computer used to
delete the five (5) files / documents from the Dropbox account, as discussed in ¶9 above.
In this report, “ES” refers to the “Evidence Sequence Number” or “ESN” that is assigned by Stroz Friedberg during
the evidence intake process.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
13. Forensic examination of Stacy Thompson’s Groupware laptop (“ES0034”) revealed
Dropbox-related web activity between March 20, 2023, and April 7, 2023. Of note, access to a
“Tim MDF.xlsx” document occurred on April 7, 2023.
14. Forensic examination of the Trace3 laptop used by Lilian Elias (“ES0024”) revealed
that 136 files / documents were deleted to the Recycle Bin on April 14, 2023, but were no longer
in the Recycle Bin at the time of the forensic preservation. This is consistent with a user of ES0024
emptying the Recycle Bin, making the content of most of these files unrecoverable. Of these 136
files / documents, only the contents of four (4) of the files were recovered from the Recycle Bin
using forensic tools.
15. Furthermore, an additional four (4) files / documents with identical file names to
some of the 136 files / documents deleted (discussed in ¶14) were located on ES0024 in the
“Downloads” directory of user “lilan.elias.” However, Stroz Friedberg cannot confirm whether
these files / documents were exact duplicates of the deleted files / documents since the contents
of the matching deleted files from ES0024 were not recoverable.
16. In his May 19, 2023, declaration, Devin Tomcik testified that he “…deleted all files
from [his personal] Dropbox folder” prior to returning his work issued laptop, “…on April 20,
2023.” Forensic examination of the Trace3 laptops issued to Devin Tomcik (“ES0006” and
“ES0007”) did not show the presence of Dropbox software on ES0006, and while Dropbox was
installed on ES0007, no Dropbox activity occurred on ES0007 after March 1, 2023. Therefore, it
appears that Devin Tomcik used a different computer to perform the stated deletions.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
17. Furthermore, while Dropbox files / documents were no longer present on ES0007
at the time of forensic preservation, Stroz Friedberg cannot confirm whether the files were
similarly removed from the Dropbox account itself and/or any other syncing devices. Stroz
Friedberg has not been given access to the Devin Tomcik Dropbox account or any other
associated devices.
18. I reviewed the legal statement made by Sycomp A Technology Company, Inc.
(“Sycomp”) in response to the court ordered forensic examination of Sycomp data. Stroz
Friedberg noted that the legal statement did not provide sufficient detail of the steps taken
during the forensic examination to reach any meaningful conclusion.
ANALYSIS OF TIMOTHY CORDELL DEVICE AND STACY THOMPSON DROPBOX ACCOUNT
19. Stroz Friedberg took custody of a corporate-issued laptop for Timothy Cordell on
May 5, 2023, from Trace3. Details, including make, model, and serial number of the laptop are
shown below in Table B.
No. ESN Make Model Serial Number Asset Tag
1 ES0029 Lenovo ThinkPad MJ-0C47W5 Not Applicable
Table B – Details pertaining to Timothy Cordell laptop
20. Stroz Friedberg created a digital forensic image 2 of the hard drive extracted from
the Timothy Cordell laptop using industry-standard methodologies that have been tested and are
2
A digital forensic image of a media is a bit-for-bit copy of the hard drive using the least intrusive methodology to
ensure that the forensic image is a true and accurate copy of the original.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
known to be reliable for purposes of preserving digital evidence. Details, including make, model,
and serial number of the hard drive are shown below in Table C.
No. ESN Make Model Serial Number Volume Serial Data
Number Capacity
1 ES0029 SKhynix HFS512GD9TNG AJ9AN58331210AM65 BE1FE9B4 512 GB
Table C – Details pertaining to the hard drive removed from Cordell laptop
21. Stroz Friedberg analyzed the digital forensic image of the hard drive extracted
from Timothy Cordell’s Groupware laptop (“ES0029”) using industry standard digital forensic
tools (such as X-Ways Forensics and Magnet AXIOM) and internally developed tools to identify
artifacts recorded by the Operating System (“OS”) which would indicate evidence of Dropbox
activity.
22. Based on analysis of the artifacts recorded by the OS on ES0029, Stroz Friedberg
identified a directory named “C:\Users\tcordell\Dropbox\.” This naming convention, in
conjunction with relevant program installations and associated configuration files, is consistent
with files contained in this folder syncing with a cloud Dropbox account.
23. Stroz Friedberg analyzed available forensic artifacts and configuration files and
identified that the Dropbox account associated with syncing on ES0029 to be
”
24. Based on analysis of the file names contained within the
C:\Users\tcordell\Dropbox\” directory, a number of these files / documents appear to be related
to Trace3 business. A listing of files contained within the “C:\Users\tcordell\Dropbox\” directory
can be found in Exhibit 2.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
25. Stroz Friedberg received access to forensically preserve the Dropbox account
(“ES0038”) associated with “ ” on June 1, 2023, and subsequently
initiated the preservation of the account using an industry standard digital forensic tool F-
Response.
26. Stroz Friedberg analyzed the activity log associated with the Dropbox account and
identified that five (5) files / documents were deleted on April 25, 2023. Due to this deletion,
these files / documents were not accessible from the Dropbox account (Table D):
No. File Name
1 Cordell Backlog.xlsx
2 T3 - Cloud Spend January 16 2023_data.csv
3 ISRG Akash ESXi Refresh.xlsx
4 Cordell Master Customer - Vendor List 2022.xlsx
5 Cordell Vendor Numbers (1).xlsx
Table D – Five (5) files / documents deleted from the Dropbox account on April 25, 2023
27. The full Dropbox activity log collected and compiled by Stroz Friedberg for the
above account is included as Exhibit 3.
28. Based on the analysis of the available evidence and the declarations of Timothy
Cordell, it appears that Timothy Cordell used a different computer than his Groupware laptop, to
access and delete the five (5) files / documents discussed above from the Dropbox account
associated with “ ”
a. Stroz Friedberg analyzed records, artifacts, and logs from this computer. No user
activity was identified after April 21, 2023, while these files / documents appear
to have been deleted from the Dropbox account on April 25, 2023.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
b. Five (5) files / documents with the same file names as those deleted from the
Dropbox account were located in the “C:\Users\tcordell\Dropbox\” directory from
Timothy Cordell’s Groupware laptop. Based on my experience and research, if
Cordell’s Groupware laptop had synced to the Dropbox account on any date since
April 25, 2023, these files / documents would have been similarly deleted from
the laptop at the time of deletion. The presence of these files / documents on the
laptop is consistent with this laptop not actively syncing with the cloud Dropbox
account at or after the time of deletion.
c. Furthermore, Stroz Friedberg cannot confirm whether any other devices were
syncing with this Dropbox account and if these files can still be found on other
synced devices.
ANALYSIS OF STACY THOMPSON DEVICE
29. Stroz Friedberg took custody of a corporate-issued laptop for Stacy Thompson on
May 24, 2023, from Trace3. Details, including make, model, and serial number of the laptop are
shown below in Table E.
No. ESN Make Model Serial Number Asset Tag
1 ES0034 Lenovo ThinkPad T490s MJ-0C47RV GW: 2205
Table E – Details pertaining to Stacy Thompson laptop
30. Stroz Friedberg created a digital forensic image of the hard drive extracted from
the Stacy Thompson laptop using industry-standard methodologies that have been tested and
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
are known to be reliable for purposes of preserving digital evidence. Details, including make,
model, and serial number of the hard drive are shown below in Table F.
No ESN Make Model Serial Number Volume Serial Data
. Number Capacity
1 ES0034 SKhynix HFS512GD9TNG AJ9AN58331210AM2X 9A4E9687 512 GB
Table F – Details pertaining to the hard drive removed from Thompson laptop
31. Stroz Friedberg analyzed the digital forensic image of the hard drive extracted
from Stacy Thompson’s Groupware laptop (“ES0034”) using industry standard digital forensic
tools (such as X-Ways Forensics and Magnet AXIOM) and internally developed tools to identify
artifacts recorded by the OS which would indicate evidence of Dropbox activity.
32. In Timothy Cordell’s May 19, 2023 declaration, in reference to using Stacy
Thompson’s Dropbox account, he testified that “…[Stacy Thompson] was not really using [her
Dropbox account] and it was easier (and cheaper) than getting [his] own account.”
33. However, based on the analysis of the artifacts recorded by the OS on ES0034,
Stroz Friedberg identified Dropbox-related web history shown in Exhibit 4.
34. Stroz Friedberg identified Dropbox-related web activity between March 20, 2023,
and April 7, 2023. Of note, access to a “Tim MDF.xlsx” document occurred on April 7, 2023.
Depending on the source device and forensic artifact, Stroz Friedberg observed the file name
with both one (1) or two (2) spaces between “Tim” and “MDF”.
a. Multiple files / documents with file names similar to “Tim MDF.xlsx” were
identified on Cordell’s Groupware laptop.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
ANALYSIS OF LILIAN ELIAS DEVICE
35. Stroz Friedberg took custody of a corporate-issued laptop for Lilian Elias on May
4, 2023, from Trace3. Details, including make, model, and serial number of the laptop are shown
below in Table G.
No. ESN Make Model Serial Number Asset Tag
1 ES0024 Lenovo ThinkBook 14 G3 ACL MP27XHX9 Trace3: 2776
Table G – Details pertaining to Lilian Elias laptop
36. Stroz Friedberg created a digital forensic image of the hard drive extracted from
the Lilian Elias laptop using industry-standard methodologies that have been tested and are
known to be reliable for purposes of preserving digital evidence. Details, including make, model,
and serial number of the hard drive are shown below in Table H.
No. ESN Make Model Serial Number Volume Serial Data
Number Capacity
1 ES0024 SKhynix HFM256GD FSB3N593912303M6A 7A8BC8C3 256 GB
3HX015N
Table H – Details pertaining to the hard drive removed from Elias laptop
37. Stroz Friedberg analyzed the digital forensic image of the hard drive extracted
from Lilian Elias Trace3 laptop (“ES0024”) using industry standard digital forensic tools (such as
X-Ways Forensics and Magnet AXIOM) and internally developed tools to identify artifacts
recorded by the OS which would indicate evidence of file and folder deletion.
38. During its analysis of ES0024, Stroz Friedberg identified 136 files / documents
deleted from the directory “C:\Users\lilian.elias\Desktop\” to the Recycle Bin on April 14, 2023,
at approximately 20:33 UTC in the span of 23 seconds. This behavior is consistent with a mass
deletion operation. Of these deleted files / documents, only 54 were uploaded to Box prior to
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
deletion. Based on the file name, a number of these files / documents appear to be related to
Trace3 business. A listing of these deleted files / documents can be found in Exhibit 5.
39. Further analysis revealed that these 136 files / documents were no longer in the
Recycle Bin at the time of the forensic preservation of ES0024. Of these 136 deleted files /
documents, only the contents of four (4) were recovered (Table I):
No. Original File Path
1 C:\Users\lilian.elias\Desktop\Packing Slip for PO 65953.pdf
2 C:\Users\lilian.elias\Desktop\Packing Slip PO 65106.pdf
3 C:\Users\lilian.elias\Desktop\Packing Slip for PO 10013 - .pdf
4 C:\Users\lilian.elias\Desktop\Packing Slip for PO 10024 - .pdf
Table I – Recovered files deleted to Recycle Bin on April 14, 2023
40. Stroz Friedberg’s analysis identified a further subset of four (4) active files /
documents with identical file names to some of the 136 files / documents deleted on April 14,
2023, from ES0024. Each file in this subset was found in the “C:\Users\lilian.elias\Downloads”
folder, while the deleted files / documents appear to have originated from the
C:\Users\lilian.elias\Desktop” folder. Based on these files not being recoverable from the
Recycle Bin, Stroz Friedberg cannot confirm that these files were exact duplicates of those
deleted (Table J):
No. Original File Path
1 C:\Users\lilian.elias\Downloads\
.xlsx
2 C:\Users\lilian.elias\Downloads\
.xlsx
3 C:\Users\lilian.elias\Downloads\
.xlsx
4 C:\Users\lilian.elias\Downloads\ .xlsx
Table J – Files / documents with identical file names to those deleted to Recycle Bin
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
ANALYSIS OF DEVIN TOMCIK DEVICES
41. Stroz Friedberg took custody corporate-issued laptops for Devin Tomcik on April
27, 2023, from Trace3. Details, including make, model, and serial number of the laptops are
shown below in Table K.
No. ESN Make Model Serial Number Asset Tag
1 ES0006 Lenovo ThinkBook 14s Yoga G2 IAP MP2CF1HB Trace3: 3155
2 ES0007 Lenovo ThinkPad X1 Yoga MJ-0FXW2V Trace3: 2288
Table K – Details pertaining to the Devin Tomcik laptops
42. Stroz Friedberg created a digital forensic image of the hard drives extracted from
the Devin Tomcik laptops using industry-standard methodologies that have been tested and are
known to be reliable for purposes of preserving digital evidence. Details, including make, model,
and serial number of the hard drive are shown below in Table L.
No. ESN Make Model Serial Number Volume Data
Serial Capacity
Number
1 ES0006 SKhynix HFM512GD3HX0 FYB7N0095142 3C449BFF 512 GB
15N 0781A
2 ES0007 KIOXIA KXG6AZNV512G 117F701XF2G3 76F9737F 512 GB
Corporation
Table L – Details pertaining to the hard drives removed from Tomcik laptops
43. Stroz Friedberg analyzed the digital forensic image of the hard drives extracted
from Devin Tomcik Trace 3 laptops (“ES0006” and “ES0007”) using industry standard digital
forensic tools (such as X-Ways Forensics and Magnet AXIOM) and internally developed tools to
identify artifacts recorded by the OS which would indicate Dropbox activity .
44. Based on analysis of the artifacts recorded by the OS on ES0007, Stroz Friedberg
identified a directory named “C:\Users\devin.tomcik\Dropbox\.” This naming convention, in
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
conjunction with relevant program installations and associated configuration files, is consistent
with files contained in this folder syncing with a cloud Dropbox account.
45. Stroz Friedberg analyzed available artifacts and identified evidence of logins to
Dropbox associated with the “ ” email address.
46. Stroz Friedberg’s analysis of forensic artifacts identified evidence of access to files
/ documents in the “C:\Users\devin.tomcik\Dropbox\” directory, which is the default location for
syncing files with Dropbox. A listing of files / documents accessed from this directory are shown
in Exhibit 6. Analysis of ES0007 showed that no files / documents existed in this directory at the
time of forensic preservation, which is consistent with these files / documents being deleted from
ES0007.
47. Stroz Friedberg cannot confirm whether the Dropbox account itself, or other
syncing devices, still maintain copies of the files / documents referenced in Exhibit 6.
a. Stroz Friedberg would require access to the “ ” Dropbox
account and associated devices to be able to determine whether the files /
documents still exist.
48. In his May 23, 2023, declaration, Devin Tomcik testified that “…[he] used a
personal Dropbox account to sync [his] work laptop, a personal laptop, and a desktop computer.”
If understood that in this statement Tomcik is referring to his Trace 3 versus Sycomp work laptop,
Tomcik does not state how Trace3 information was synced to his personal laptop or desktop.
Tomcik further does not state if this practice of syncing his personal Dropbox account to his work
laptop continued when starting employment at Sycomp.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
49. Based on analysis of the artifacts recorded by the OS on ES0006, Stroz Friedberg
did not identify any activity related to the use of Dropbox on this device.
50. Further analysis revealed that syncing activity with Dropbox on ES0007 last
occurred on February 28, 2023, and the “C:\Users\devin.tomcik\Dropbox\” directory was last
modified on March 1, 2023.
51. In his May 19, 2023, declaration, Devin Tomcik testified that he “…deleted all files
from [his personal] Dropbox folder” prior to returning his work issued laptop, “…on April 20,
2023.” As such it appears that Devin Tomcik used a different computer to perform these
deletions.
ANALYSIS OF COURT-ORDERED FORENSIC EXAM
52. Stroz Friedberg reviewed the June 12, 2023, legal statement made by Sycomp A
Technology Company, Inc. (“Sycomp”) in response to the court ordered forensic exam of Sycomp
data. Stroz Friedberg noted the following after review of the legal statement:
a. The legal statement does not appear to contain information from, or references
to, a separate declaration discussing the technical aspects of the analysis which
would allow someone to reach the conclusions offered in the legal statement.
b. The legal statement does not address the parameters that were used for searching
to determine a potential match, such as file name, content keyword, or hash
value, or how the search accommodated for potentially deleted data.
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
c. The legal statement does provide sufficient information on the parameters of the
selection process that determined which devices and / or accounts were subject
to the search.
d. The legal statement does not explain how false positives were identified and
classified as such. For example, how “…a file name matching the exact file name”
of the 9 files provided by Trace3 and found to be a later iteration of one of these
documents could be classified as a false positive.
Stroz Friedberg’s work on this matter is ongoing and Stroz Friedberg reserves the right to
supplement the findings as additional analysis is performed.
I declare under penalty of perjury under the laws of the State of California that the foregoing is
true and correct. Executed July6, 2023, at Henderson, Nevada.
Sergio D. Kopelev
Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response
EXHIBIT 1
Evidence Analyzed by Stroz Friedberg
Davis Wright Tremaine, LLP (Project Baelish)
Privileged and Confidential
ESN Custodian Device Type Source Association Hostname Date Preserved Acquired By
ES0006 Devin Tomcik Laptop Trace3 T3-0858546 2023-04-27 Stroz Friedberg
ES0007 Devin Tomcik Laptop Trace3 DEVIN WORK LAPT 2023-04-27 Stroz Friedberg
ES0024 Lilian Elias Laptop Trace3 T3-9938694 2023-05-04 Stroz Friedberg
ES0029 Tim Cordell Laptop GroupWare TCORDELL-490-GW-LT 2023-05-05 Stroz Friedberg
ES0034 Stacy Thompson Laptop GroupWare STACY-490 2023-05-24 Stroz Friedberg
ES0038 Stacy Thompson Loose Files Dropbox Personal 2023-06-05 Stroz Friedberg
EXHIBIT 2
FILED
CONDITIONALLY
UNDER SEAL
EXHIBIT 3
FILED
CONDITIONALLY
UNDER SEAL
EXHIBIT 4
Dropbox-Related Chrome Web History and Visits in 2023 from Stacy Thompson GroupWare Laptop - ES0034
Davis Wright Tremaine, LLP (Project Baelish)
Privileged and Confidential
# Date Visited (UTC) URL Title Visit Count
1 03/20/2023 02:48:01 https://www.google.com/search?q=dropbox&rlz=1C1GCEB_enUS941US941&oq=dropbox&aqs dropbox - Google Search 2
2 03/20/2023 02:48:12 https://www.dropbox.com/login Home - Dropbox 1
3 03/20/2023 02:48:12 https://www.dropbox.com/h Home - Dropbox 1
4 03/20/2023 02:48:52 https://help.dropbox.com/installs-integrations/sync-uploads/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 1
5 03/20/2023 02:48:52 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help
6 03/20/2023 02:50:45 https://www.dropbox.com/home Recents - Dropbox
7 03/20/2023 02:50:45 https://www.dropbox.com/home Files - Dropbox
8 03/20/2023 02:50:47 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox
9 03/20/2023 02:50:50 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox
10 03/20/2023 16:23:54 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help
11 03/20/2023 23:37:45 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
12 03/20/2023 23:37:46 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
13 03/20/2023 23:37:48 https://www.dropbox.com/home/PPP%20Loan/PPP%20LOAN%209.12.22 PPP LOAN 9.12.22 - Dropbox
14 03/20/2023 23:37:55 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
15 https://www.dropbox.com/referrer_cleansing_redirect?hmac=wpujH34VIyDg5wEOZWhtO%2B
03/20/2023 23:38:45 RvLr5QdJKb6DsrotALkPg%3D&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffo%2Fvxkgam Error - Dropbox 1
16 03/20/2023 23:38:46 https://www.dropbox.com/scl/fo/vxkgamlcn2bc3sscivsj7/h?dl=0&rlkey=1gnq3hd8yw4851s3qa Error - Dropbox 1
17 03/20/2023 23:39:32 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help
18 03/20/2023 23:40:07 https://www.dropbox.com/home/PPP%20Loan/PPP%20LOAN%209.12.22 PPP LOAN 9.12.22 - Dropbox
19 03/20/2023 23:40:15 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
20 03/20/2023 23:45:17 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
21 03/20/2023 23:45:37 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
22 03/20/2023 23:45:42 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
23 03/20/2023 23:45:47 https://www.dropbox.com/home/PPP%20Loan/PPP%20LOAN%209.12.22 PPP LOAN 9.12.22 - Dropbox 3
24 03/20/2023 23:46:09 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
25 03/20/2023 23:46:13 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
26 03/20/2023 23:46:20 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
27 03/20/2023 23:46:24 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox
28 03/20/2023 23:46:33 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox
29 03/20/2023 23:46:58 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 13
30 03/20/2023 23:47:01 https://www.dropbox.com/home Recents - Dropbox
31 03/20/2023 23:47:01 https://www.dropbox.com/home Files - Dropbox
32 03/20/2023 23:47:52 https://www.dropbox.com/home?manage_folder_subscription=PPP+Loan Files - Dropbox 1
33 03/20/2023 23:47:55 https://www.dropbox.com/home Recents - Dropbox
34 03/20/2023 23:47:55 https://www.dropbox.com/home Files - Dropbox
35 03/20/2023 23:50:24 https://www.dropbox.com/share?_tk=web_left_nav_bar&role=personal Shared - Dropbox 1
36 03/20/2023 23:50:24 https://www.dropbox.com/share/recents Dropbox
37 03/20/2023 23:51:50 https://www.dropbox.com/home/Audit%20Folder/Finance%20Folder Finance Folder - Dropbox
38 03/20/2023 23:52:19 https://www.dropbox.com/home/Audit%20Folder/Finance%20Folder Finance Folder - Dropbox 2
39 03/20/2023 23:52:23 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox 4
40 03/20/2023 23:52:37 https://www.dropbox.com/home Recents - Dropbox
41 03/20/2023 23:52:37 https://www.dropbox.com/home Files - Dropbox
42 03/20/2023 23:52:58 https://www.dropbox.com/home/2012%20%26%20Corrinas%2016th 2012 & Corrinas 16th - Dropbox 1
43 03/20/2023 23:53:01 https://www.dropbox.com/home Files - Dropbox 6
Page 1 of 2 Prepared on 7/7/2023
# Date Visited (UTC) URL Title Visit Count
44 03/20/2023 23:53:01 https://www.dropbox.com/home Recents - Dropbox
45 03/20/2023 23:53:34 https://www.dropbox.com/home/National%20Sales%20Meeting%202015%20-%20SF Dropbox
46 03/21/2023 21:09:02 https://www.dropbox.com/home/National%20Sales%20Meeting%202015%20-%20SF Dropbox 1
47 03/21/2023 21:09:02 https://www.dropbox.com/share/recents Dropbox 1
48 03/21/2023 21:09:03 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 1
49 03/22/2023 18:17:18 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 1
50 04/07/2023 17:56:17 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 14
51 04/07/2023 17:56:37 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal&di=left_nav Recents - Dropbox
52 04/07/2023 17:56:39 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=Tim++MDF.x Recents - Dropbox
53 04/07/2023 17:57:36 https://www.dropbox.com/cloud_docs/new API Request Authorization - Dropbox 1
54 04/07/2023 17:57:37 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- API Request Authorization - Dropbox 1
55 https://www.dropbox.com/1/oauth2/authorize?client_id=hprgkn88j6tngvz&redirect_uri=https
04/07/2023 17:57:37 %3A%2F%2Fwww.dropbox.com%2Fow%2Fmsft%2Foauth_callback&require_uid=204504454&r API Request Authorization - Dropbox 1
56 04/07/2023 17:57:42 https://www.dropbox.com/home Recents - Dropbox 6
57 https://www.dropbox.com/ow/msft/oauth_callback?error=access_denied&error_description=
04/07/2023 17:57:42 The+user+chose+not+to+give+your+app+access+to+their+Dropbox+account.&state=AZUoWi36 Recents - Dropbox 1
58 04/07/2023 17:57:45 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal&di=left_nav Recents - Dropbox 2
59 04/07/2023 17:57:47 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=AZ+tracking. Recents - Dropbox 1
60 04/07/2023 17:57:51 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&role=personal Recents - Dropbox
61 04/07/2023 17:57:52 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=Tim++MDF.x Recents - Dropbox
62 04/07/2023 17:58:13 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Dropbox 1
63 04/07/2023 17:58:14 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Tim MDF - Google Sheets 1
64 04/07/2023 17:58:20 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 1
65 04/07/2023 17:58:20 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 1
66 04/07/2023 17:58:21 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Tim MDF.xlsx 1
67 04/07/2023 18:10:59 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&role=personal Recents - Dropbox 2
68 04/07/2023 18:11:01 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=Tim++MDF.x Recents - Dropbox 3
69 04/07/2023 18:11:05 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Dropbox 1
70 04/07/2023 18:11:06 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Tim MDF - Google Sheets 1
71 04/07/2023 18:11:09 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 2
72 04/07/2023 18:11:09 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 2
Page 2 of 2
Preview
NICOLE PHILLIS (SBN 291266) nicolephillis@dwt.com DAVIS WRIGHT TREMAINE LLP 865 S. Figueroa St., Suite 2400 Los Angeles, California 90017-2566 Telephone: (213) 633-6800 Facsimile: (213) 633-6899 JEREMY MERKELSON (pro hac vice forthcoming) jeremymerkelson@dwt.com DAVIS WRIGHT TREMAINE LLP 1301 K Street NW, Suite 500 East Washington, D.C. 20005 Telephone: (202) 973-4260 Facsimile: (202) 973-4472 Attorneys for Plaintiff TRACE3, LLC SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA TRACE3, LLC, a California limited liability Case No. 23CV415833 company; Assigned to Hon. Sunil R. Kulkarni Plaintiff, SYCOMP A TECHNOLOGY COMPANY, DECLARATION OF SERGIO D. INC., a California corporation; TIMOTHY KOPELEV IN SUPPORT OF PLAINTIFF CORDELL, an individual; LILIAN ELIAS, an TRACE3, LLC’S MOTION TO MODIFY individual; GEOFFREY PETERSON, an TEMPORARY RESTRAINING ORDER individual; DEVIN TOMCIK, an individual; AND ORDER AUTHORIZING and DOES 1-10, inclusive, EXPEDITED DISCOVERY Defendants. [Notice of Motion and Memorandum of Points and Authorities; Declarations of Jeremy Morris and Nicole S. Phillis; [Proposed] Order filed concurrently] Date: July 28, 2023 Time: 9:00 a.m. Dept: Action Filed: May 12, 2023 DECLARATION OF SERGIO D. KOPELEV DECLARATION OF SERGIO D. KOPELEV I, Sergio D. Kopelev, declare as follows: 1. I am over the age of eighteen and am not operating under any mental disabilities. I have personal knowledge of the matter set forth herein and if called upon to testify, I could and would competently testify as follows. BACKGROUND & QUALIFICATIONS 2. I am currently employed as a Vice President with Stroz Friedberg, an Aon company (“Stroz Friedberg”). 3. I have been involved in the field of Computer Forensics since 1997. Since that 10 time, I have received over 700 hours of specialized training and education in the forensic 11 examination of digital evidence and computer media. I have extensive experience in the 12 forensic examination of digital evidence and computer media and have performed or supervised 13 over 1,000 computer forensic examinations, including e-discovery work conducted in 14 connection with civil litigation, financial restatements and government investigations. 15 4. I routinely assist clients through the successful management of large-scale 16 electronic discovery and computer forensics projects. I am a frequent lecturer and writer on the 17 topic of computer forensics and electronic discovery, and have published articles in the Los 18 Angeles Daily Journal, the Nevada Lawyer, as well as the Law Enforcement Technology 19 magazine. I have also been interviewed on CNN, National Public Radio, and by the Los 20 Angeles Times as an industry expert in computer forensics, and have provided testimony and 21 offered expert reports in jurisdictions across the U.S. 22 5. Prior to joining Stroz Friedberg, I was a Senior Director at Consilio, LLC and 23 Huron Legal. Prior to that, I was a principal with LECG, as well as a senior manager, director 24 and regional practice leader with Deloitte and KPMG accounting firms. Prior to entering the 25 private sector, I worked for 8 years in law enforcement, culminating with the rank of sergeant 26 with the Bedford County, Virginia, Sheriff’s Department, where I organized and supervised a 27 multi-agency Internet crimes taskforce called “Operation Blue Ridge Thunder.” 28 2 DECLARATION OF SERGIO D. KOPELEV 6. I am a summa cum laude graduate of the University of Massachusetts (Boston) with a Bachelor of Arts degree from the College of Public and Community Service, as well as an Masters of Fine Arts degree from Hollins University. Additionally, I have previously received the following professional computer forensics certifications: EnCase Certified Examiner (EnCE), Certified PDA Examiner (CPDAE), Certified Forensic Computer Examiner (CFCE), and Certified Electronic Evidence Collection Specialist (CEECS). 7. My hourly rate for this matter is $525 per hour. 8. My complete CV is attached as Exhibit 1 to Exhibit A. RETENTION AND ASSIGNMENT 10 9. In late April 2023, Stroz Friedberg was retained by Davis Wright Tremaine, 11 LLP (“Counsel”) on behalf of its client, Trace3, LLC (“Trace3”), to provide digital forensic 12 consulting and technical services, including review of corporate-managed cloud accounts and 13 company-issued electronic devices, where possible, for Brian Bartel (“Bartel”), Brian Law 14 (“Law”), Dawn McCale (“McCale”), Devin Tomcik (“Tomcik”), Geoff Peterson (“Peterson”), 15 Jasen Paris (“Paris”), John Barnes (“Barnes”), Kelly Phipps (“Phipps”), Lilian Elias (“Elias”), 16 Tim Cordell (“Cordell”), and Tim Smith (“Smith”), collectively referred to as the “Users of 17 Interest.” 18 10. Counsel also requested that Stroz Friedberg forensically preserve and analyze 19 available audit logs from the corporate-managed instance of Box for evidence of downloading 20 or deletion of business-related documents by accounts associated with the Users of Interest. 21 Similar preservation and analysis efforts are currently underway for additional corporate- 22 managed cloud applications. 23 11. Counsel requested that Stroz Friedberg forensically preserve and analyze the 24 hard drives extracted from a company-issued laptops belonging to Geoff Peterson, Devin 25 Tomcik, Dawn McCale, Tim Cordell, and Lilian Elias for evidence of copying or spoliation of 26 27 28 Box, Inc. develops and maintains a cloud-based file sharing and collaboration platform for businesses. 3 DECLARATION OF SERGIO D. KOPELEV business-related documents. Similar preservation and analysis efforts are currently underway for additional company-issued devices and custodians. 12. Counsel requested that Stroz Friedberg forensically preserve and analyze Universal Serial Bus (“USB”) devices belonging to Geoff Peterson and Dawn McCale for evidence of copying or exfiltrating business-related documents. Similar preservation and analysis efforts are currently underway for additional company-issued devices and custodians. 13. Following issuance of the TRO and the filing of declarations from Geoffrey Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias in opposition to Trace3’s ex parte application, Trace3 requested that I conduct additional forensic review based upon the 10 representations made in the Individual Defendants’ declarations. I reviewed the declarations of 11 Geoffrey Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias and conducted further 12 analysis to ascertain when and from which devices the admitted file deletion took place. I also 13 analyzed the evidence to determine whether Defendants have accounted for all apparent copies 14 of the Trace3 confidential and trade secret information in their possession, custody, and control. 15 14. Evidence items reviewed for purposes of this Declaration are shown in Exhibit 16 2 to Exhibit A. 17 OPINIONS AND FINDINGS 18 15. Attached as Exhibit A is a true and correct declaration of my findings. 19 I declare under penalty of perjury under the laws of the State of California that the 20 foregoing is true and correct. 21 Executed this 6th of July, 2023, at Henderson, Nevada. 22 23 Sergio D. Kopelev 24 25 26 27 28 4 DECLARATION OF SERGIO D. KOPELEV EXHIBIT A DECLARATION OF SERGIO D. KOPELEV IN SUPPORT OF PLAINTIFF TRACE3, LLC’S MOTION TO MODIFY TEMPORARY RESTRAINING ORDER AND ORDER AUTHORIZING EXPEDITED DISCOVERY 2nd DECLARATION OF SERGIO D. KOPELEV I, Sergio D. Kopelev, depose and say under penalty of perjury that: 1. I am over the age of eighteen and am not operating under any mental disabilities. I have personal knowledge of the matter set forth herein and if called upon to testify, I could and would competently testify as follows. 2. I have provided a Declaration to the Court in support of Trace3, LLC’s Ex Parte Application for Temporary Restraining Order and OSC RE Preliminary Injunction, which described by background and professional qualifications. I am incorporating Paragraphs 1-8 of that declaration by reference as if they are fully stated herein. RETENTION AND ASSIGNMENT 3. In late April 2023, Stroz Friedberg was retained by Davis Wright Tremaine, LLP (“Counsel”) on behalf of its client, Trace3, LLC (“Trace3”), to provide digital forensic consulting and technical services, including review of Trace3’s corporate-managed cloud accounts and company-issued electronic devices, where possible, for Brian Bartel (“Bartel”), Brian Law (“Law”), Dawn McCale (“McCale”), Devin Tomcik (“Tomcik”), Geoff Peterson (“Peterson”), Jasen Paris (“Paris”), John Barnes (“Barnes”), Kelly Phipps (“Phipps”), Lilian Elias (“Elias”), Timothy Cordell (“Cordell”), Tim Smith (“Smith”) and Stacy Thompson (“Thompson”), collectively referred to as the “Users of Interest.” 4. Following issuance of the TRO and the filing of declarations from Geoffrey Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias in opposition to Trace3’s ex parte Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response application, Trace3 requested that I conduct additional forensic analysis based upon the representations made in the Individual Defendants’ declarations. I reviewed the declarations of Geoffrey Peterson, Devon Tomcik, Timothy Cordell, and Lilian Elias and conducted further forensic review to ascertain when and from which devices the stated file deletion took place. I also analyzed the evidence to determine whether Defendants have accounted for all apparent copies of the Trace3 confidential and trade secret information in their possession, custody, and control. 5. In furtherance of the work previously performed, Stroz Friedberg forensically preserved and analyzed the hard drive extracted from a company-issued laptop belonging to Timothy Cordell, Stacy Thompson, and Devin Tomcik for evidence of Dropbox activity. 6. Stroz Friedberg, with consent from Stacy Thompson, forensically preserved and analyzed the Dropbox account associated with the non-corporate email address .” 7. Stroz Friedberg forensically preserved and analyzed the hard drive extracted from a company-issued laptop belonging to Lilian Elias for evidence of deletion activity. 8. Evidence items analyzed for purposes of this Declaration are shown in Exhibit 1. 9. Stroz Friedberg also reviewed the Declarations of Geoffrey Peterson, Lilian Elias and Devon Tomcik, and the two declarations of Timothy Cordell. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response SUMMARY OF FINDINGS 10. Stroz Friedberg analyzed available activity from the Dropbox account associated with the non-corporate email address “ ” (“ES0038 ”) and determined that five (5) files / documents (Table A below) appear to have been deleted on April 25, 2023, and were no longer accessible from the Dropbox account. No. File Name 1 Cordell Backlog.xlsx 2 T3 - Cloud Spend January 16 2023_data.csv 3 ISRG Akash ESXi Refresh.xlsx 4 Cordell Master Customer - Vendor List 2022.xlsx 5 Cordell Vendor Numbers (1).xlsx Table A – Five (5) files / documents deleted from the Dropbox account on April 25, 2023 11. Forensic examination of the Groupware laptop used by Timothy Cordell (“ES0029”) revealed evidence consistent with files contained in a folder on this laptop syncing with a cloud Dropbox account associated with the “ ” email address. Forensic examination also revealed that five (5) files / documents with the same file names as those deleted from the Dropbox account (¶10) were found on ES0029. 12. Forensic examination of ES0029 did not reveal any records, artifacts, or logs for user activity after April 21, 2023. As such, it appears that ES0029 is not the computer used to delete the five (5) files / documents from the Dropbox account, as discussed in ¶9 above. In this report, “ES” refers to the “Evidence Sequence Number” or “ESN” that is assigned by Stroz Friedberg during the evidence intake process. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response 13. Forensic examination of Stacy Thompson’s Groupware laptop (“ES0034”) revealed Dropbox-related web activity between March 20, 2023, and April 7, 2023. Of note, access to a “Tim MDF.xlsx” document occurred on April 7, 2023. 14. Forensic examination of the Trace3 laptop used by Lilian Elias (“ES0024”) revealed that 136 files / documents were deleted to the Recycle Bin on April 14, 2023, but were no longer in the Recycle Bin at the time of the forensic preservation. This is consistent with a user of ES0024 emptying the Recycle Bin, making the content of most of these files unrecoverable. Of these 136 files / documents, only the contents of four (4) of the files were recovered from the Recycle Bin using forensic tools. 15. Furthermore, an additional four (4) files / documents with identical file names to some of the 136 files / documents deleted (discussed in ¶14) were located on ES0024 in the “Downloads” directory of user “lilan.elias.” However, Stroz Friedberg cannot confirm whether these files / documents were exact duplicates of the deleted files / documents since the contents of the matching deleted files from ES0024 were not recoverable. 16. In his May 19, 2023, declaration, Devin Tomcik testified that he “…deleted all files from [his personal] Dropbox folder” prior to returning his work issued laptop, “…on April 20, 2023.” Forensic examination of the Trace3 laptops issued to Devin Tomcik (“ES0006” and “ES0007”) did not show the presence of Dropbox software on ES0006, and while Dropbox was installed on ES0007, no Dropbox activity occurred on ES0007 after March 1, 2023. Therefore, it appears that Devin Tomcik used a different computer to perform the stated deletions. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response 17. Furthermore, while Dropbox files / documents were no longer present on ES0007 at the time of forensic preservation, Stroz Friedberg cannot confirm whether the files were similarly removed from the Dropbox account itself and/or any other syncing devices. Stroz Friedberg has not been given access to the Devin Tomcik Dropbox account or any other associated devices. 18. I reviewed the legal statement made by Sycomp A Technology Company, Inc. (“Sycomp”) in response to the court ordered forensic examination of Sycomp data. Stroz Friedberg noted that the legal statement did not provide sufficient detail of the steps taken during the forensic examination to reach any meaningful conclusion. ANALYSIS OF TIMOTHY CORDELL DEVICE AND STACY THOMPSON DROPBOX ACCOUNT 19. Stroz Friedberg took custody of a corporate-issued laptop for Timothy Cordell on May 5, 2023, from Trace3. Details, including make, model, and serial number of the laptop are shown below in Table B. No. ESN Make Model Serial Number Asset Tag 1 ES0029 Lenovo ThinkPad MJ-0C47W5 Not Applicable Table B – Details pertaining to Timothy Cordell laptop 20. Stroz Friedberg created a digital forensic image 2 of the hard drive extracted from the Timothy Cordell laptop using industry-standard methodologies that have been tested and are 2 A digital forensic image of a media is a bit-for-bit copy of the hard drive using the least intrusive methodology to ensure that the forensic image is a true and accurate copy of the original. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response known to be reliable for purposes of preserving digital evidence. Details, including make, model, and serial number of the hard drive are shown below in Table C. No. ESN Make Model Serial Number Volume Serial Data Number Capacity 1 ES0029 SKhynix HFS512GD9TNG AJ9AN58331210AM65 BE1FE9B4 512 GB Table C – Details pertaining to the hard drive removed from Cordell laptop 21. Stroz Friedberg analyzed the digital forensic image of the hard drive extracted from Timothy Cordell’s Groupware laptop (“ES0029”) using industry standard digital forensic tools (such as X-Ways Forensics and Magnet AXIOM) and internally developed tools to identify artifacts recorded by the Operating System (“OS”) which would indicate evidence of Dropbox activity. 22. Based on analysis of the artifacts recorded by the OS on ES0029, Stroz Friedberg identified a directory named “C:\Users\tcordell\Dropbox\.” This naming convention, in conjunction with relevant program installations and associated configuration files, is consistent with files contained in this folder syncing with a cloud Dropbox account. 23. Stroz Friedberg analyzed available forensic artifacts and configuration files and identified that the Dropbox account associated with syncing on ES0029 to be ” 24. Based on analysis of the file names contained within the C:\Users\tcordell\Dropbox\” directory, a number of these files / documents appear to be related to Trace3 business. A listing of files contained within the “C:\Users\tcordell\Dropbox\” directory can be found in Exhibit 2. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response 25. Stroz Friedberg received access to forensically preserve the Dropbox account (“ES0038”) associated with “ ” on June 1, 2023, and subsequently initiated the preservation of the account using an industry standard digital forensic tool F- Response. 26. Stroz Friedberg analyzed the activity log associated with the Dropbox account and identified that five (5) files / documents were deleted on April 25, 2023. Due to this deletion, these files / documents were not accessible from the Dropbox account (Table D): No. File Name 1 Cordell Backlog.xlsx 2 T3 - Cloud Spend January 16 2023_data.csv 3 ISRG Akash ESXi Refresh.xlsx 4 Cordell Master Customer - Vendor List 2022.xlsx 5 Cordell Vendor Numbers (1).xlsx Table D – Five (5) files / documents deleted from the Dropbox account on April 25, 2023 27. The full Dropbox activity log collected and compiled by Stroz Friedberg for the above account is included as Exhibit 3. 28. Based on the analysis of the available evidence and the declarations of Timothy Cordell, it appears that Timothy Cordell used a different computer than his Groupware laptop, to access and delete the five (5) files / documents discussed above from the Dropbox account associated with “ ” a. Stroz Friedberg analyzed records, artifacts, and logs from this computer. No user activity was identified after April 21, 2023, while these files / documents appear to have been deleted from the Dropbox account on April 25, 2023. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response b. Five (5) files / documents with the same file names as those deleted from the Dropbox account were located in the “C:\Users\tcordell\Dropbox\” directory from Timothy Cordell’s Groupware laptop. Based on my experience and research, if Cordell’s Groupware laptop had synced to the Dropbox account on any date since April 25, 2023, these files / documents would have been similarly deleted from the laptop at the time of deletion. The presence of these files / documents on the laptop is consistent with this laptop not actively syncing with the cloud Dropbox account at or after the time of deletion. c. Furthermore, Stroz Friedberg cannot confirm whether any other devices were syncing with this Dropbox account and if these files can still be found on other synced devices. ANALYSIS OF STACY THOMPSON DEVICE 29. Stroz Friedberg took custody of a corporate-issued laptop for Stacy Thompson on May 24, 2023, from Trace3. Details, including make, model, and serial number of the laptop are shown below in Table E. No. ESN Make Model Serial Number Asset Tag 1 ES0034 Lenovo ThinkPad T490s MJ-0C47RV GW: 2205 Table E – Details pertaining to Stacy Thompson laptop 30. Stroz Friedberg created a digital forensic image of the hard drive extracted from the Stacy Thompson laptop using industry-standard methodologies that have been tested and Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response are known to be reliable for purposes of preserving digital evidence. Details, including make, model, and serial number of the hard drive are shown below in Table F. No ESN Make Model Serial Number Volume Serial Data . Number Capacity 1 ES0034 SKhynix HFS512GD9TNG AJ9AN58331210AM2X 9A4E9687 512 GB Table F – Details pertaining to the hard drive removed from Thompson laptop 31. Stroz Friedberg analyzed the digital forensic image of the hard drive extracted from Stacy Thompson’s Groupware laptop (“ES0034”) using industry standard digital forensic tools (such as X-Ways Forensics and Magnet AXIOM) and internally developed tools to identify artifacts recorded by the OS which would indicate evidence of Dropbox activity. 32. In Timothy Cordell’s May 19, 2023 declaration, in reference to using Stacy Thompson’s Dropbox account, he testified that “…[Stacy Thompson] was not really using [her Dropbox account] and it was easier (and cheaper) than getting [his] own account.” 33. However, based on the analysis of the artifacts recorded by the OS on ES0034, Stroz Friedberg identified Dropbox-related web history shown in Exhibit 4. 34. Stroz Friedberg identified Dropbox-related web activity between March 20, 2023, and April 7, 2023. Of note, access to a “Tim MDF.xlsx” document occurred on April 7, 2023. Depending on the source device and forensic artifact, Stroz Friedberg observed the file name with both one (1) or two (2) spaces between “Tim” and “MDF”. a. Multiple files / documents with file names similar to “Tim MDF.xlsx” were identified on Cordell’s Groupware laptop. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response ANALYSIS OF LILIAN ELIAS DEVICE 35. Stroz Friedberg took custody of a corporate-issued laptop for Lilian Elias on May 4, 2023, from Trace3. Details, including make, model, and serial number of the laptop are shown below in Table G. No. ESN Make Model Serial Number Asset Tag 1 ES0024 Lenovo ThinkBook 14 G3 ACL MP27XHX9 Trace3: 2776 Table G – Details pertaining to Lilian Elias laptop 36. Stroz Friedberg created a digital forensic image of the hard drive extracted from the Lilian Elias laptop using industry-standard methodologies that have been tested and are known to be reliable for purposes of preserving digital evidence. Details, including make, model, and serial number of the hard drive are shown below in Table H. No. ESN Make Model Serial Number Volume Serial Data Number Capacity 1 ES0024 SKhynix HFM256GD FSB3N593912303M6A 7A8BC8C3 256 GB 3HX015N Table H – Details pertaining to the hard drive removed from Elias laptop 37. Stroz Friedberg analyzed the digital forensic image of the hard drive extracted from Lilian Elias Trace3 laptop (“ES0024”) using industry standard digital forensic tools (such as X-Ways Forensics and Magnet AXIOM) and internally developed tools to identify artifacts recorded by the OS which would indicate evidence of file and folder deletion. 38. During its analysis of ES0024, Stroz Friedberg identified 136 files / documents deleted from the directory “C:\Users\lilian.elias\Desktop\” to the Recycle Bin on April 14, 2023, at approximately 20:33 UTC in the span of 23 seconds. This behavior is consistent with a mass deletion operation. Of these deleted files / documents, only 54 were uploaded to Box prior to Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response deletion. Based on the file name, a number of these files / documents appear to be related to Trace3 business. A listing of these deleted files / documents can be found in Exhibit 5. 39. Further analysis revealed that these 136 files / documents were no longer in the Recycle Bin at the time of the forensic preservation of ES0024. Of these 136 deleted files / documents, only the contents of four (4) were recovered (Table I): No. Original File Path 1 C:\Users\lilian.elias\Desktop\Packing Slip for PO 65953.pdf 2 C:\Users\lilian.elias\Desktop\Packing Slip PO 65106.pdf 3 C:\Users\lilian.elias\Desktop\Packing Slip for PO 10013 - .pdf 4 C:\Users\lilian.elias\Desktop\Packing Slip for PO 10024 - .pdf Table I – Recovered files deleted to Recycle Bin on April 14, 2023 40. Stroz Friedberg’s analysis identified a further subset of four (4) active files / documents with identical file names to some of the 136 files / documents deleted on April 14, 2023, from ES0024. Each file in this subset was found in the “C:\Users\lilian.elias\Downloads” folder, while the deleted files / documents appear to have originated from the C:\Users\lilian.elias\Desktop” folder. Based on these files not being recoverable from the Recycle Bin, Stroz Friedberg cannot confirm that these files were exact duplicates of those deleted (Table J): No. Original File Path 1 C:\Users\lilian.elias\Downloads\ .xlsx 2 C:\Users\lilian.elias\Downloads\ .xlsx 3 C:\Users\lilian.elias\Downloads\ .xlsx 4 C:\Users\lilian.elias\Downloads\ .xlsx Table J – Files / documents with identical file names to those deleted to Recycle Bin Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response ANALYSIS OF DEVIN TOMCIK DEVICES 41. Stroz Friedberg took custody corporate-issued laptops for Devin Tomcik on April 27, 2023, from Trace3. Details, including make, model, and serial number of the laptops are shown below in Table K. No. ESN Make Model Serial Number Asset Tag 1 ES0006 Lenovo ThinkBook 14s Yoga G2 IAP MP2CF1HB Trace3: 3155 2 ES0007 Lenovo ThinkPad X1 Yoga MJ-0FXW2V Trace3: 2288 Table K – Details pertaining to the Devin Tomcik laptops 42. Stroz Friedberg created a digital forensic image of the hard drives extracted from the Devin Tomcik laptops using industry-standard methodologies that have been tested and are known to be reliable for purposes of preserving digital evidence. Details, including make, model, and serial number of the hard drive are shown below in Table L. No. ESN Make Model Serial Number Volume Data Serial Capacity Number 1 ES0006 SKhynix HFM512GD3HX0 FYB7N0095142 3C449BFF 512 GB 15N 0781A 2 ES0007 KIOXIA KXG6AZNV512G 117F701XF2G3 76F9737F 512 GB Corporation Table L – Details pertaining to the hard drives removed from Tomcik laptops 43. Stroz Friedberg analyzed the digital forensic image of the hard drives extracted from Devin Tomcik Trace 3 laptops (“ES0006” and “ES0007”) using industry standard digital forensic tools (such as X-Ways Forensics and Magnet AXIOM) and internally developed tools to identify artifacts recorded by the OS which would indicate Dropbox activity . 44. Based on analysis of the artifacts recorded by the OS on ES0007, Stroz Friedberg identified a directory named “C:\Users\devin.tomcik\Dropbox\.” This naming convention, in Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response conjunction with relevant program installations and associated configuration files, is consistent with files contained in this folder syncing with a cloud Dropbox account. 45. Stroz Friedberg analyzed available artifacts and identified evidence of logins to Dropbox associated with the “ ” email address. 46. Stroz Friedberg’s analysis of forensic artifacts identified evidence of access to files / documents in the “C:\Users\devin.tomcik\Dropbox\” directory, which is the default location for syncing files with Dropbox. A listing of files / documents accessed from this directory are shown in Exhibit 6. Analysis of ES0007 showed that no files / documents existed in this directory at the time of forensic preservation, which is consistent with these files / documents being deleted from ES0007. 47. Stroz Friedberg cannot confirm whether the Dropbox account itself, or other syncing devices, still maintain copies of the files / documents referenced in Exhibit 6. a. Stroz Friedberg would require access to the “ ” Dropbox account and associated devices to be able to determine whether the files / documents still exist. 48. In his May 23, 2023, declaration, Devin Tomcik testified that “…[he] used a personal Dropbox account to sync [his] work laptop, a personal laptop, and a desktop computer.” If understood that in this statement Tomcik is referring to his Trace 3 versus Sycomp work laptop, Tomcik does not state how Trace3 information was synced to his personal laptop or desktop. Tomcik further does not state if this practice of syncing his personal Dropbox account to his work laptop continued when starting employment at Sycomp. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response 49. Based on analysis of the artifacts recorded by the OS on ES0006, Stroz Friedberg did not identify any activity related to the use of Dropbox on this device. 50. Further analysis revealed that syncing activity with Dropbox on ES0007 last occurred on February 28, 2023, and the “C:\Users\devin.tomcik\Dropbox\” directory was last modified on March 1, 2023. 51. In his May 19, 2023, declaration, Devin Tomcik testified that he “…deleted all files from [his personal] Dropbox folder” prior to returning his work issued laptop, “…on April 20, 2023.” As such it appears that Devin Tomcik used a different computer to perform these deletions. ANALYSIS OF COURT-ORDERED FORENSIC EXAM 52. Stroz Friedberg reviewed the June 12, 2023, legal statement made by Sycomp A Technology Company, Inc. (“Sycomp”) in response to the court ordered forensic exam of Sycomp data. Stroz Friedberg noted the following after review of the legal statement: a. The legal statement does not appear to contain information from, or references to, a separate declaration discussing the technical aspects of the analysis which would allow someone to reach the conclusions offered in the legal statement. b. The legal statement does not address the parameters that were used for searching to determine a potential match, such as file name, content keyword, or hash value, or how the search accommodated for potentially deleted data. Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response c. The legal statement does provide sufficient information on the parameters of the selection process that determined which devices and / or accounts were subject to the search. d. The legal statement does not explain how false positives were identified and classified as such. For example, how “…a file name matching the exact file name” of the 9 files provided by Trace3 and found to be a later iteration of one of these documents could be classified as a false positive. Stroz Friedberg’s work on this matter is ongoing and Stroz Friedberg reserves the right to supplement the findings as additional analysis is performed. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct. Executed July6, 2023, at Henderson, Nevada. Sergio D. Kopelev Trace3 – Declaration of Sergio Kopelev Stroz Friedberg Digital Forensics and Incident Response EXHIBIT 1 Evidence Analyzed by Stroz Friedberg Davis Wright Tremaine, LLP (Project Baelish) Privileged and Confidential ESN Custodian Device Type Source Association Hostname Date Preserved Acquired By ES0006 Devin Tomcik Laptop Trace3 T3-0858546 2023-04-27 Stroz Friedberg ES0007 Devin Tomcik Laptop Trace3 DEVIN WORK LAPT 2023-04-27 Stroz Friedberg ES0024 Lilian Elias Laptop Trace3 T3-9938694 2023-05-04 Stroz Friedberg ES0029 Tim Cordell Laptop GroupWare TCORDELL-490-GW-LT 2023-05-05 Stroz Friedberg ES0034 Stacy Thompson Laptop GroupWare STACY-490 2023-05-24 Stroz Friedberg ES0038 Stacy Thompson Loose Files Dropbox Personal 2023-06-05 Stroz Friedberg EXHIBIT 2 FILED CONDITIONALLY UNDER SEAL EXHIBIT 3 FILED CONDITIONALLY UNDER SEAL EXHIBIT 4 Dropbox-Related Chrome Web History and Visits in 2023 from Stacy Thompson GroupWare Laptop - ES0034 Davis Wright Tremaine, LLP (Project Baelish) Privileged and Confidential # Date Visited (UTC) URL Title Visit Count 1 03/20/2023 02:48:01 https://www.google.com/search?q=dropbox&rlz=1C1GCEB_enUS941US941&oq=dropbox&aqs dropbox - Google Search 2 2 03/20/2023 02:48:12 https://www.dropbox.com/login Home - Dropbox 1 3 03/20/2023 02:48:12 https://www.dropbox.com/h Home - Dropbox 1 4 03/20/2023 02:48:52 https://help.dropbox.com/installs-integrations/sync-uploads/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 1 5 03/20/2023 02:48:52 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 6 03/20/2023 02:50:45 https://www.dropbox.com/home Recents - Dropbox 7 03/20/2023 02:50:45 https://www.dropbox.com/home Files - Dropbox 8 03/20/2023 02:50:47 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox 9 03/20/2023 02:50:50 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox 10 03/20/2023 16:23:54 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 11 03/20/2023 23:37:45 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 12 03/20/2023 23:37:46 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 13 03/20/2023 23:37:48 https://www.dropbox.com/home/PPP%20Loan/PPP%20LOAN%209.12.22 PPP LOAN 9.12.22 - Dropbox 14 03/20/2023 23:37:55 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 15 https://www.dropbox.com/referrer_cleansing_redirect?hmac=wpujH34VIyDg5wEOZWhtO%2B 03/20/2023 23:38:45 RvLr5QdJKb6DsrotALkPg%3D&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffo%2Fvxkgam Error - Dropbox 1 16 03/20/2023 23:38:46 https://www.dropbox.com/scl/fo/vxkgamlcn2bc3sscivsj7/h?dl=0&rlkey=1gnq3hd8yw4851s3qa Error - Dropbox 1 17 03/20/2023 23:39:32 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 18 03/20/2023 23:40:07 https://www.dropbox.com/home/PPP%20Loan/PPP%20LOAN%209.12.22 PPP LOAN 9.12.22 - Dropbox 19 03/20/2023 23:40:15 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 20 03/20/2023 23:45:17 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 21 03/20/2023 23:45:37 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 22 03/20/2023 23:45:42 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 23 03/20/2023 23:45:47 https://www.dropbox.com/home/PPP%20Loan/PPP%20LOAN%209.12.22 PPP LOAN 9.12.22 - Dropbox 3 24 03/20/2023 23:46:09 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 25 03/20/2023 23:46:13 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 26 03/20/2023 23:46:20 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 27 03/20/2023 23:46:24 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox 28 03/20/2023 23:46:33 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 29 03/20/2023 23:46:58 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 13 30 03/20/2023 23:47:01 https://www.dropbox.com/home Recents - Dropbox 31 03/20/2023 23:47:01 https://www.dropbox.com/home Files - Dropbox 32 03/20/2023 23:47:52 https://www.dropbox.com/home?manage_folder_subscription=PPP+Loan Files - Dropbox 1 33 03/20/2023 23:47:55 https://www.dropbox.com/home Recents - Dropbox 34 03/20/2023 23:47:55 https://www.dropbox.com/home Files - Dropbox 35 03/20/2023 23:50:24 https://www.dropbox.com/share?_tk=web_left_nav_bar&role=personal Shared - Dropbox 1 36 03/20/2023 23:50:24 https://www.dropbox.com/share/recents Dropbox 37 03/20/2023 23:51:50 https://www.dropbox.com/home/Audit%20Folder/Finance%20Folder Finance Folder - Dropbox 38 03/20/2023 23:52:19 https://www.dropbox.com/home/Audit%20Folder/Finance%20Folder Finance Folder - Dropbox 2 39 03/20/2023 23:52:23 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal Recents - Dropbox 4 40 03/20/2023 23:52:37 https://www.dropbox.com/home Recents - Dropbox 41 03/20/2023 23:52:37 https://www.dropbox.com/home Files - Dropbox 42 03/20/2023 23:52:58 https://www.dropbox.com/home/2012%20%26%20Corrinas%2016th 2012 & Corrinas 16th - Dropbox 1 43 03/20/2023 23:53:01 https://www.dropbox.com/home Files - Dropbox 6 Page 1 of 2 Prepared on 7/7/2023 # Date Visited (UTC) URL Title Visit Count 44 03/20/2023 23:53:01 https://www.dropbox.com/home Recents - Dropbox 45 03/20/2023 23:53:34 https://www.dropbox.com/home/National%20Sales%20Meeting%202015%20-%20SF Dropbox 46 03/21/2023 21:09:02 https://www.dropbox.com/home/National%20Sales%20Meeting%202015%20-%20SF Dropbox 1 47 03/21/2023 21:09:02 https://www.dropbox.com/share/recents Dropbox 1 48 03/21/2023 21:09:03 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 1 49 03/22/2023 18:17:18 https://help.dropbox.com/sync/files-not-syncing Fix syncing problems in Dropbox - Dropbox Help 1 50 04/07/2023 17:56:17 https://www.dropbox.com/home/PPP%20Loan PPP Loan - Dropbox 14 51 04/07/2023 17:56:37 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal&di=left_nav Recents - Dropbox 52 04/07/2023 17:56:39 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=Tim++MDF.x Recents - Dropbox 53 04/07/2023 17:57:36 https://www.dropbox.com/cloud_docs/new API Request Authorization - Dropbox 1 54 04/07/2023 17:57:37 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- API Request Authorization - Dropbox 1 55 https://www.dropbox.com/1/oauth2/authorize?client_id=hprgkn88j6tngvz&redirect_uri=https 04/07/2023 17:57:37 %3A%2F%2Fwww.dropbox.com%2Fow%2Fmsft%2Foauth_callback&require_uid=204504454&r API Request Authorization - Dropbox 1 56 04/07/2023 17:57:42 https://www.dropbox.com/home Recents - Dropbox 6 57 https://www.dropbox.com/ow/msft/oauth_callback?error=access_denied&error_description= 04/07/2023 17:57:42 The+user+chose+not+to+give+your+app+access+to+their+Dropbox+account.&state=AZUoWi36 Recents - Dropbox 1 58 04/07/2023 17:57:45 https://www.dropbox.com/recents?_tk=web_left_nav_bar&role=personal&di=left_nav Recents - Dropbox 2 59 04/07/2023 17:57:47 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=AZ+tracking. Recents - Dropbox 1 60 04/07/2023 17:57:51 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&role=personal Recents - Dropbox 61 04/07/2023 17:57:52 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=Tim++MDF.x Recents - Dropbox 62 04/07/2023 17:58:13 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Dropbox 1 63 04/07/2023 17:58:14 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Tim MDF - Google Sheets 1 64 04/07/2023 17:58:20 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 1 65 04/07/2023 17:58:20 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 1 66 04/07/2023 17:58:21 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Tim MDF.xlsx 1 67 04/07/2023 18:10:59 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&role=personal Recents - Dropbox 2 68 04/07/2023 18:11:01 https://www.dropbox.com/recents?_tk=web_left_nav_bar&di=left_nav&preview=Tim++MDF.x Recents - Dropbox 3 69 04/07/2023 18:11:05 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Dropbox 1 70 04/07/2023 18:11:06 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim- Tim MDF - Google Sheets 1 71 04/07/2023 18:11:09 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 2 72 04/07/2023 18:11:09 https://www.dropbox.com/scl/fi/i0tsdwi89dmpqan0t8lrq/Tim-- Tim MDF.xlsx 2 Page 2 of 2