meridian-trade-secret-theft — departing engineer exfil trail
Meridian Semiconductor MRD-TS-2026-4410 — departing engineer D. Okonkwo copied chip layout + firmware to removable media and personal sync folder via LNK, shellbags, jump lists, and print spooler artifacts. Fully synthetic.
what this proves
- all eight trade-secret-theft primary engines produce deterministic, fixture-locked output — verified by
npm run check:flagship(728/728 fleet · 8 for this scenario). - every output is generated 100% locally in your browser — image the workstation, never upload HR data.
- usb/cad exfil paths, lnk deleted-target gaps on E:, shellbags and jump list corroboration, and confidential print jobs surface without sending evidence to a server.
primary engines locked to this fixture
build the case binder
runs all eight primary engines on the synthetic evidence zip and opens a self-contained html binder. uses the default binder renderer for trade-secret-theft — no upload.
runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload
download the synthetic evidence
MIT-licensed, fully synthetic. includes usb and repo lnk shortcuts, lecmd batch export, partial mft with deleted usb targets, usrclass shellbags, explorer jump lists, print spool shd, print service evtx, and printed docx with embedded printer metadata.
built deterministically from scripts/fixtures/build-meridian-trade-secret-theft.mjs. seed: meridian-trade-secret-theft:v1.
methodology
trade secret theft is sequence — repo access, then usb staging, then cloud archive. walk lnk deep analyzer → lnk timeline correlator → lnk batch timeline correlator → shellbags analyzer → jump list parser → jumplist deep correlator → print spool forensics → document print history extractor. R. Navarro copied customer-list.xlsx and HughesCAD core.dll to E: before the competitor exit — lnk targets survive after the usb copy is deleted. read the full trade secret / IP theft guide →
after the playbook
run each primary locally — or export findings from the binder — then drop every csv/json into fatcousin-multi-tool-super-timeline-correlator. one timestamp-sorted timeline across lnk usb staging, shellbags/jump list corroboration, and confidential print job — still zero upload.