Form S-1

(Address, including zip code, and telephone number, including area code, of registrant’s principal executive offices)

(Name, address, including zip code, and telephone number, including area code, of agent for service)

Approximate date of commencement of proposed sale to the public: As soon as practicable after this Registration Statement becomes effective.

If any of the securities being registered on this Form are to be offered on a delayed or continuous basis pursuant to Rule 415 under the Securities Act of 1933, check the following box. ¨

If this Form is filed to register additional securities for an offering pursuant to Rule 462(b) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. ¨

If this Form is a post-effective amendment filed pursuant to Rule 462(c) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. ¨

If this Form is a post-effective amendment filed pursuant to Rule 462(d) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. ¨

The Registrant hereby amends this Registration Statement on such date or dates as may be necessary to delay its effective date until the Registrant shall file a further amendment which specifically states that this Registration Statement shall thereafter become effective in accordance with Section 8(a) of the Securities Act of 1933 or until the Registration Statement shall become effective on such date as the Securities and Exchange Commission acting pursuant to said Section 8(a), may determine.

The information contained in this prospectus is not complete and may be changed. We may not sell these securities until the registration statement filed with the Securities and Exchange Commission is effective. This prospectus is not an offer to sell these securities and we are not soliciting offers to buy these securities in any jurisdiction where the offer or sale is not permitted.

Guidance Software, Inc. is offering shares of its common stock, and the selling stockholders are offering shares of common stock. We will not receive any proceeds from the sale of shares by the selling stockholders. This is our initial public offering and no public market currently exists for our shares. We anticipate that the initial public offering price will be between $ and $ per share.

We will apply to have our common stock approved for quotation on the NASDAQ Global Market under the symbol “GUID.”

Investing in our common stock involves risks. See “ Risk Factors” beginning on page 7.

We and the selling stockholders have granted the underwriters the right to purchase up to an additional shares of common stock to cover over-allotments.

The Securities and Exchange Commission and state securities regulators have not approved or disapproved these securities, or determined if this prospectus is truthful or complete. Any representation to the contrary is a criminal offense.

Morgan Stanley & Co. Incorporated expects to deliver the shares to purchasers on , 2006.


		Page
Prospectus Summary		1
Risk Factors		7
Special Note Regarding Forward-Looking Statements		22
Use of Proceeds		23
Dividend Policy		23
S Corporation Status		24
Capitalization		25
Dilution		26
Selected Consolidated Financial Data		27
Management’s Discussion and Analysis of Financial Condition and Results of Operations		29
Business		49
Management		67

You should rely only on the information contained in this prospectus. We have not authorized anyone to provide you with information different from that contained in this prospectus. We are offering to sell, and seeking offers to buy, shares of our common stock only in jurisdictions where offers and sales are permitted. The information contained in this prospectus is accurate only as of the date of this prospectus, regardless of the time of delivery of this prospectus or of any sale of our common stock.

Until , 2006 (25 days after the commencement of this offering), all dealers that effect transactions in these securities, whether or not participating in this offering, may be required to deliver a prospectus. This is in addition to the dealer’s obligation to deliver a prospectus when acting as an underwriter with respect to unsold allotments or subscriptions.

For investors outside the United States: Neither we nor any of the underwriters have done anything that would permit this offering or possession or distribution of this prospectus in any jurisdiction where action for that purpose is required, other than in the United States. You are required to inform yourselves about and to observe any restrictions relating to this offering and the distribution of this prospectus.

You should read the following summary together with the entire prospectus, including the more detailed information in our consolidated financial statements and related notes appearing elsewhere in this prospectus, before making an investment decision. You should carefully consider, among other things, the matters discussed in “Risk Factors.”

We develop and provide the leading software solutions for digital investigations. EnCase^® Enterprise, our flagship product, enables corporations and government agencies to search, collect, preserve and analyze, from a single location, data across the servers, desktops and laptops that comprise their entire network. Our EnCase^® Forensic software, which we believe is the industry standard tool in the field of digital forensic software, is used primarily by law enforcement and government agencies for searching, collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court proceedings. We also offer a comprehensive array of forensic investigation and training services to help our customers manage their internal digital investigations, including eDiscovery requests, and learn how to effectively and efficiently use our software. Our EnCase^® Enterprise customer base currently includes more than 90 of the Fortune 500, and we have deployed approximately 24,000 units of our EnCase^® Forensic software to more than 1,000 government and law enforcement agencies and other customers worldwide.

Our objective is to enhance our position as a leading global provider of digital investigation solutions for large corporations, government organizations and law enforcement agencies. The key elements of our strategy include:

The global adoption of local area networks, wide area networks, e-mail and the Internet has increased communications within and between organizations and has created the ability to generate, store, share and distribute massive amounts of electronic information instantaneously without regard to physical location. While the adoption and reliance on these technologies has significantly increased productivity and lowered the cost of doing business for Global 2000 companies and other organizations, it has also exposed organizations to many increasing areas of risk associated with the continued proliferation of electronic data. Organizations now are increasingly faced with the need to recover and analyze vast amounts of electronic data quickly and efficiently through processes we refer to as digital investigations. Digital investigations are conducted to address various electronic data-related needs, including:

digital investigations at any time or on any scale, quickly respond to eDiscovery requests and take decisive action in response to internal and external IT security and data breaches. The market for digital investigation and cyber forensics solutions is expected to grow from $600 million in 2005 to $1.4 billion in 2009, representing a compounded annual growth rate of 24%, according to International Data Corporation. The market for eDiscovery solutions is expected to grow from $832 million in 2004 to $3.1 billion in 2008, representing a compounded annual growth rate of approximately 40%, according to Socha-Gelbmann. According to the 2005 Litigation Trends Survey by Fulbright & Jaworski LLP, a law firm, the average U.S. corporation with over $1 billion in revenues is involved in more than 140 domestic lawsuits at any given time. This survey polled 354 corporate general counsel in the United States and United Kingdom.

We were incorporated in the State of California in 1997 and intend to reincorporate in Delaware prior to the completion of this offering. Our principal executive offices are located at 215 North Marengo Avenue, Pasadena, California 91101, and our telephone number is (626) 229-9191. Our website address is www.guidancesoftware.com. Information contained on our website is not incorporated by reference into this prospectus, and you should not consider information contained on our website as part of this prospectus. Unless otherwise indicated, the terms “Guidance Software, Inc.” “Guidance,” the “Company,” “we,” “us” and “our” refer to Guidance Software, Inc. and its subsidiary.

“Guidance,” “EnScript^®,” “EnCase^® Enterprise,” “Snapshot,” “EnCase^® eDiscovery Suite,” “EnCase^® Enterprise AIRS” “EnCase^® Forensic,” “FastBloc^®,” “CEIC^®,” “EnCE^™” and other trademarks or service marks of Guidance appearing in this prospectus are registered trademarks or trademarks of Guidance in the United States and in certain other jurisdictions. This prospectus also contains additional trade names, trademarks and service marks of ours and of other companies. We do not intend our use or display of other companies’ trade names, trademarks or service marks to imply a relationship with, or endorsement or sponsorship of us by, these other companies.

The number of shares of common stock to be outstanding after this offering is based on 18,801,565 shares outstanding as of August 31, 2006 and:

Except as otherwise indicated, all information contained in this prospectus assumes:

The following tables provide our summary consolidated financial data. The summary consolidated statement of operations data for each of the three years in the period ended December 31, 2005, have been derived from our audited consolidated financial statements appearing elsewhere in this prospectus. The summary consolidated statement of operations data for the six month periods ended June 30, 2005 and 2006 and the summary consolidated balance sheet data as of June 30, 2006, have been derived from our unaudited consolidated financial statements appearing elsewhere in this prospectus. This information is unaudited but, in management’s opinion, has been prepared on the same basis as the audited consolidated financial statements and related notes included elsewhere in this prospectus and includes all adjustments, consisting only of normal recurring adjustments, that our management considers necessary for a fair presentation of the information for the periods presented. You should read this information together with our consolidated financial statements and related notes and the information under “Management’s Discussion and Analysis of Financial Condition and Results of Operations” appearing elsewhere in this prospectus.

Investing in our common stock involves a high degree of risk. You should carefully consider the following risk factors in addition to the other information contained in this prospectus before purchasing our common stock. If any of the following risks occurs, our business, financial condition, results of operations and prospects could be materially adversely affected. As a result, the trading price of our common stock could decline and you could lose part or all of your investment.

Our operating results may fluctuate from period to period and within each period, which makes our operating results difficult to predict and could cause our revenues, expenses and profitability to fall short of expectations during certain periods.

Our operating results may fluctuate from period to period or within certain periods as a result of a number of factors, many of which are outside of our control. You should not rely on our past results as an indication of future performance, as our operating results in the future may fall below expectations, expenses could increase and revenues could decrease. Each of the risks described in this section, as well as other factors, may affect our operating results. For example, our quarterly revenues and operating results may fluctuate as a result of a variety of factors, including, but not limited to, our lengthy sales cycle, the proportion of revenues attributable to license fees versus services and maintenance revenue, changes in the level of fixed operating expenses, demand for our products and services, the introduction of new products and product enhancements or upgrades by us or our competitors, changes in customer budgets and capital expenditure plans, competitive conditions in the industry and general economic conditions. In addition, many customers make major software acquisitions near the end of their fiscal years, which tends to cause our revenues to be higher in the third and fourth calendar quarters, the fiscal year ends of many government agencies and corporations, and lower in the first calendar quarter. In addition, many customers tend to make software acquisitions or purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of the period in question until software purchase decisions have been made. Since each of our EnCase^® Enterprise product sales are generally large-scale license agreements, a short delay in just one of these software sales from one quarter into a subsequent quarter or a loss of one of these potential sales could cause us to deliver results for a quarter that are below projections of securities analysts that follow our results. This could cause our stock price to decline significantly. There can be no assurance that we will be able to successfully address these risks, and we may not be profitable in any future period.

If the corporate market for digital investigation software does not develop, we will not be able to maintain our growth.

The market for digital investigation software is new and is being developed largely through our efforts. Our growth is dependent upon, among other things, the size and pace at which the market for such software develops. If the market for such digital investigation software decreases, remains constant or grows more slowly than we anticipate, we will not be able to maintain our recent rate of growth. Continued growth in the demand for our products is uncertain resulting from, among other things, the fact that:

Even if digital investigation software gains wide market acceptance, our software may not adequately address market requirements and may not continue to gain market acceptance. If digital investigation software

generally, or our software specifically, do not gain wide market acceptance, we may not be able to maintain our recent rate of growth and our revenues and results of operations would be adversely affected.

The failure of the legal community to adopt our eDiscovery Suite solution could negatively affect future sales of EnCase^® Enterprise.

We expect to derive a significant amount of sales of EnCase^® Enterprise from continuing demand for our EnCase^® eDiscovery Suite solution. However, widespread adoption of eDiscovery best practices will require a shift in the way the legal community approaches discovery of electronic documents and other electronically stored data. Currently, most large scale electronic discovery projects are conducted by outsourced service providers that manually retrieve documents from each computer subject to review. These service providers have long-standing and entrenched relationships with the corporations that are subject to large-scale discovery inquiries or security breaches and the large law firms that are typically retained in connection with such discovery projects. Corporations and law firms may continue to prefer to use service providers because of these ongoing established relationships, and because the service providers are widely known and accepted within the legal community and may resist adoption of our EnCase^® eDiscovery Suite solution. Moreover, the expense of relying on an outsourced service provider may frequently be covered by the corporation’s insurance policy that is otherwise covering the expense of the litigation, including complying with requests for discovery, while implementation of EnCase^® Enterprise and our EnCase^® eDiscovery Suite would require a significant unreimbursed capital expenditure by the corporation. The failure of corporations and law firms to adopt our EnCase^® eDiscovery Suite or our solutions to be used for eDiscovery could have a material adverse effect on our sales and results of operations.

Our software products and services are often used in connection with legal investigations, civil litigation and criminal prosecutions. The admissibility of results generated by our products as evidence in civil and criminal trials is a key component of our customer value proposition. Evidence and the manner used to collect evidence is regularly the subject of challenges in legal investigations and litigation, and our products or personnel may be the direct or indirect subject of such legal challenges. Persons involved in litigation may, for example, challenge the reliability of our products, the admissibility of evidence generated, discovered or collected using our products, and/or the expertise, credibility or reliability of our personnel. Other unpredictable legal challenges may be brought that could reflect upon the reputation of our products or personnel. To date, courts that have addressed challenges to our products or services have ruled against such challenges. If in the future a court were to find that our products are not reliable or that persons representing us or users of our product are not credible, reliable or lack the expertise necessary to serve as a witness or to authenticate evidence, or that our training and certification process does not adequately prepare individuals to conduct competent digital investigations, this could have a material adverse impact on our revenues and results of operations.

We are dependent on our management and research and development teams, and the loss of any key member of either of these teams may prevent us from executing our business strategy.

Our future success depends in a large part upon the continued services of our executive officers and other key personnel. In particular, Shawn McCreight, our founder, Chairman and Chief Technology Officer, has been significantly responsible for the development of our products. In addition, John Colbert, our Chief Executive Officer, has been responsible for a number of our significant strategic initiatives. We are also substantially dependent on the continued services of our existing research and development personnel. We have fewer research and development employees than many competitors of comparable size due to the high degree of expertise required to work with our complex technology and our stringent hiring standards. The loss of one or more of our key employees, and in particular our research and development personnel, could seriously harm our business development, culture and strategic direction. We do not maintain key person life insurance policies on all of our executives. Any key person life insurance policy we maintain now or in the future would not be sufficient to cover the loss of any of our management or key personnel and any such loss could seriously harm our business and our ability to execute our business strategy.

Changes or reforms in the law or regulatory landscape could diminish the need for our solutions, and could have a negative impact on our business.

One factor that drives demand for our products and services is the legal and regulatory framework in which our customers operate. Laws and regulations are subject to drastic changes and these could either help or hurt the demand for our products. Thus, certain changes in the law and regulatory landscape, such as tort law or legislative reforms that limit the scope and size of electronic discovery requests or the admissibility of evidence generated by such requests, as well as court decisions, could significantly harm our business. Changes in domestic and international privacy laws could also affect the demand and acceptance of our products, and such changes could have a material impact on our revenues.

We face direct and indirect competition from other software companies, as well as other companies that provide training, consulting and certification services in computer forensics.

The markets for our software products and services are competitive, highly fragmented and subject to rapidly changing technology, shifting customer needs and frequent introductions of new products and services. We expect the intensity of competition to increase in the future as new companies enter our markets, existing competitors develop stronger capabilities and we expand into other markets. Many of our current competitors have longer operating histories, greater name recognition, access to larger customer bases and substantially more extensive resources than we have. They may be able to devote greater resources to the development, promotion and sale of their products than we can to ours, which could allow them to respond more quickly than we can to new technologies and changes in customer needs and achieve wider market acceptance. Because the barriers to entry into software industry segments are generally low, we expect to continue to face competition from new entrants, particularly as we expand into other segments of the software industry.

Several competing companies provide digital investigation software and applications that directly compete or will compete with our products, or offer solutions our products do not address. In addition, if the market for digital investigation software develops as we anticipate, other companies could enter this market through their own software development or through the acquisition of one of our current competitors. If these companies are more successful in providing similar, better or less expensive digital investigation solutions compared to those that we offer, we could experience a decline in customers and revenue. These companies include computer forensic companies, managed security services companies and consulting companies, such as the “Big 4” consulting/accounting firms, many of which have substantially greater resources and customer bases than we do. If our competitors are more successful than we are at generating professional services engagements, our growth rate or revenues may decline.

We also compete with companies or organizations that have developed or are developing and marketing software and services that diminish the need for our solutions or the budget available to our customers to purchase our solutions. These companies include traditional security companies, data storage infrastructure companies and internal IT organizations that develop their own security systems. We also compete indirectly with providers of corporate insurance to the Global 2000, whose policies in question permit and pay for the use of consulting and other services to defend in litigation but not the purchase of digital investigation software to enhance the overall capabilities for a company.

Computer hackers may damage our products, services and systems, which could cause interruptions in our service and harm to our business, and hackers could gain access to our customers’ personal information which could result in the loss of existing clients, negative publicity and legal liability.

Computer hackers often attempt to access personal information for purposes of identify theft and other criminal activity. In particular, due to the nature of our business, the products and services that we offer and the industry in which we operate, we are more likely to be the target of computer hackers who would like to undermine our ability to offer the products and services that we provide to our customers and possibly retaliate for the results or evidence that our products and services generate.

For example, in December 2005, we became aware of a security breach of our electronic records which contained, among other things, credit card information of approximately 5,000 customers. We promptly notified law enforcement authorities as well as each of the customers whose information may have been compromised. We conducted a forensic examination of the incident and took a number of steps to both remediate the underlying cause and strengthen our internal security system, including enhancing our internal information technology security department and redesigning our network architecture.

In early January 2006, the Federal Trade Commission commenced an inquiry into the security breach. We have fully cooperated with the FTC’s inquiry and the FTC has proposed a draft consent decree that would require third party monitoring of our IT security systems for a period of years. This proposed consent decree does not include monetary penalties. We are currently discussing the terms of such a decree with the FTC.

In addition, several customers who were notified have sought compensation, which in each case has been satisfied by payment of amounts which are not material to us, and one has commenced litigation against us. In connection with this breach, we have paid $11,500 in fines to credit card processing companies. However, we may still face additional legal and administrative action with respect to the incident. In addition, the incident received publicity and could adversely affect our ability to retain and attract customers. Given the incident, any subsequent breach of our security could be especially damaging to our reputation and business and may result in monetary penalties if the FTC were to deem the circumstances that lead to the breach as a violation of any of our obligations under a potential consent decree.

In addition, from time to time we may be targets of computer hackers who, among other things, create viruses to sabotage or otherwise attack companies’ networks, products and services. For example, there was recently a spread of viruses, or worms, that intentionally deleted anti-virus and firewall software. Our products, networks, websites and systems, may be the target of attacks by hackers. If successful, any of these events could damage our computer systems, force us to incur substantial costs to fix technical problems or result in hackers gaining access to our technical and other proprietary information, which could harm our business and results of operations.

If we fail to develop or maintain an effective system of internal controls, we may not be able to accurately report our financial results or prevent fraud. As a result, current and potential shareholders could lose confidence in our financial reporting, which would harm our business and the trading price of our common stock.

Effective internal controls are necessary for us to provide reliable financial reports and effectively prevent fraud and to operate successfully as a public company. If we cannot provide reliable financial reports or prevent fraud, our reputation and operating results would be harmed. We have in the past discovered, and may in the future discover, areas of our internal controls that need improvement.

In connection with the audit of our financial statements for the year ended December 31, 2005, in July 2006, our independent registered public accounting firm reported to our audit committee several matters that are “material weaknesses” in our internal controls over financial reporting as defined by the standards established by the Public Company Accounting Oversight Board. In addition, in June 2005, in connection with their audit of our financial statements for the year ended December 31, 2004, our previous independent registered public accounting firm reported “material weaknesses” in our internal controls as defined by the standards established by the Public Company Accounting Oversight Board. A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. These material weaknesses may have contributed to the errors corrected in the restatement of our financial statements for the year ended December 31, 2004 and prior years. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Accounting Restatements.”

We have begun our remediation efforts and we believe that our actions in this regard have strengthened our internal controls over financial reporting. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Internal Controls Over Financial Reporting.” Although initiated, our plan to improve the effectiveness of our internal controls and processes is not complete. It will take some time to put in place the rigorous disclosure controls and procedures desired by our management and our board of directors. We cannot at this time estimate how long it will take to complete the steps identified above. Our management will continue to evaluate the effectiveness of the control environment and will continue to refine existing controls. We cannot assure you that the measures we have taken to date or any future measures will remediate the material weaknesses reported by our independent registered public accounting firms. Additional deficiencies in our internal controls may be discovered in the future. Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our prior period financial statements. Ineffective internal controls could also cause investors to lose confidence in our reported financial information, which would likely have a negative effect on the trading price of our common stock.

We also have not yet implemented a complete disaster recovery plan or business continuity plan for our accounting and related information technology systems. Any disaster could therefore materially impair our ability to maintain timely accounting and reporting.

In connection with the audit of our 2005 financial statements and the identification of material weaknesses previously described above, we discovered accounting inaccuracies in our previously audited financial statements and accordingly restated our results with regard to the year ended December 31, 2004 and prior years. We determined that we had not properly applied certain accounting guidance contained in Statement of Position (“SOP”) 97-2 “Software Revenue Recognition” and related interpretations. The improper application of these principles resulted in the premature recognition of revenue that should have been deferred to later periods. The revenue adjustment and related impact on accrued expenses resulted in changes in our revenue and net income for the years ended December 2002, 2003 and 2004, as detailed in “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Accounting Restatements.”

In addition, during 2004, we incorrectly applied the provisions of Statements of Financial Accounting Standards (“SFAS”) No. 86, “Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise Marketed.” Specifically, we capitalized software development costs that should have been expensed. Our restated 2004 consolidated financial statements reflect additional research and development expense which had previously been capitalized. Our 2003 balance sheet was also restated to recognize real property leasehold incentives that previously were not accounted for in our financial statements. The impact of these restatements on our financial statements for the years ended December 31, 2003 and 2004, are detailed in “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Accounting Restatements.”

If we are required to restate our financial statements in the future, we may be the subject of negative publicity focusing on the financial statement inaccuracies and resulting restatement. In the past, certain publicly traded companies that have restated their financial statements have been subject to shareholder derivative actions. The occurrence of any of the foregoing could harm our business and reputation and cause the price of our common stock to decline after this offering.

Our operating results and business would be seriously impaired if our revenues from our EnCase^® Enterprise product were to decline.

Historically, we have derived substantially all of our license revenues from sales of our EnCase^® Forensic and EnCase^® Enterprise product offerings. Although we have introduced new software modules, we expect that our EnCase^® Enterprise product offering will account for the largest portion of our software product for the

foreseeable future. Although we have no reason to believe that sales of EnCase^® Forensic will decline in future periods, we believe that the degree of penetration for our EnCase^® Forensic product in the law enforcement market makes it unlikely that revenue from sales of EnCase^® Forensic will contribute dramatically to future revenue growth. For this reason, we are dependent on increased sales of EnCase^® Enterprise to drive future growth.

As a result, if for any reason revenue from our EnCase^® Enterprise product offerings declines or does not increase as rapidly as we anticipate, our operating results and our prospects for growth will be significantly impaired. Further, if these products fail to meet the needs of our existing and target customers, or if they do not compare favorably in price and performance to competing products, our business will be adversely affected.

We may be limited in our ability to utilize indirect sales channels, such as value-added resellers, corporate resellers, professional services firms and other third-party distributors for the sale and distribution of our products, which may limit our ability to expand our customer base and our revenues.

We may be limited in our ability to market and distribute our products through value-added resellers, corporate resellers, professional services firms and other third-party distributors, which we collectively refer to as third-party resellers, due to various factors. Due to the complex nature of our products, sales professionals generally require a significant amount of time and effort to become sufficiently familiar with our products in order to be able to market them effectively, which makes our products unattractive to third-party resellers. In addition, our competitors include professional services organizations, such as accounting, consulting and law firms, that would otherwise serve as a natural distribution channel for our products and related services.

Moreover, there is significant competition in our industry for qualified third-party resellers. Even if we were to succeed in attracting qualified and capable third-party resellers, we would likely have relatively short-term contracts and no minimum purchase commitments with any existing and future third-party resellers. In addition, agreements with such third-party resellers are generally renewable annually, not exclusive and may be terminated by either party within 30 days after the initial six-month period of the agreement, and with 30 days notice after the initial one-year period. If we are not able to recruit new qualified third-party resellers, our sales growth may be constrained and our results of operations would suffer.

Our intellectual property rights are valuable, and if we are unable to protect our proprietary technologies and defend infringement claims, we could lose our competitive advantage and our business could be adversely affected.

Our success depends in part on our ability to protect our proprietary products and services and to defend against infringement claims. If we are unable to do so, our business and financial results may be adversely affected. To protect our proprietary technology, we rely upon a combination of copyright, patent, trademark and trade secret law, confidentiality restrictions in contracts with employees, customers and other third parties, software security measures, and registered copyrights, trademarks and patents. If we fail to protect our intellectual property rights adequately, our competitors may gain access to our technology, and our business may be harmed. Any of our patents, trademarks, copyrights or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation proceedings. In addition, we may be unable to obtain patent, copyright or trademark protection on products that we spend significant time and expense to develop in the future. Despite our efforts to protect our proprietary technology, unauthorized persons may be able to copy, reverse engineer or otherwise use some of our proprietary technology. Furthermore, existing patent and copyright laws may afford only limited protection, and the laws of certain countries in which we operate do not protect proprietary technology as well as established law in the United States. For these reasons, we may have difficulty protecting our proprietary technology against unauthorized copying or use. If any of these events happen, there could be a material adverse effect on the value of our proprietary technology and on our business and financial results. In addition, litigation may be necessary to protect our proprietary technology. This type of litigation is often costly and time-consuming, with no assurance of success.

Claims that we misuse the intellectual property of others could subject us to significant legal liability and disrupt our business, which could have a material adverse effect on our financial condition and results of operations.

Because of the nature of our business, we may become subject to material claims of infringement by competitors and other third parties with respect to our current or future software applications, trademarks or other proprietary rights. The legal framework for software patents is rapidly evolving and we expect that software developers will increasingly be subject to infringement claims as the number of software applications and competitors in our industry segment grows. In certain circumstances, the owners of proprietary software could make copyright and/or patent infringement claims against us in connection with such activity. Any such claims, whether meritorious or not, could be time-consuming and difficult to defend against, result in costly litigation, cause shipment delays or require us to enter into royalty or licensing agreements with third parties, which may not be available on terms that we deem acceptable, if at all. Any of these claims could disrupt our business, make it difficult to add or retain important features in our products and have a material adverse effect on our financial condition and results of operations.

If we are unable to continue to obtain government licenses, approvals or authorizations regarding the export of our products abroad, or if current or future export laws limit or otherwise restrict our business, we could be prohibited from shipping our products to certain countries, which could negatively impact our business, financial condition and results of operations.

We must comply with United States laws regulating the export of our products to other countries. Our products contain encryption and decryption technologies that require us to obtain certain licenses from the United States government in order to export certain of our products abroad. In addition, we are required to obtain licenses from foreign governments in order to import our products into these countries. We cannot assure you that we will be successful in obtaining such licenses, approvals and other authorizations required from applicable governmental authorities to export our products. The export regimes and the governing policies applicable to our business are subject to change, and we cannot assure you that such export approvals or authorizations will be available to us or for our products in the future. Our failure to receive any required export license, approval or authorization would hinder our ability to sell our products and could negatively impact our business, financial condition and results of operations.

We are growing rapidly, and if we are not able to effectively manage and support our growth or retain and attract highly skilled employees, our business strategy might not succeed.

In the past we have grown rapidly and we will need to continue to grow in all areas of our operations to execute our business strategy. Managing and sustaining our growth will place significant demands on management as well as on our administrative, operational, technical and financial systems and controls and other resources. We may not be able to expand our product offerings, our customer base and markets, or implement other features of our business strategy at the rate or to the extent presently planned. In addition, our traditionally high level of customer service may suffer as we grow, which could cause our software sales to suffer. If we are unable to successfully manage or support our future growth, we may not be able to maximize revenues or profitability.

In addition, in order to be able to effectively execute our rapid growth plan, we must attract and retain highly qualified personnel. We will need to hire additional personnel in virtually all operational areas, including selling and marketing, research and development, professional services, training, customer service and administration. Competition in our industry for experienced and qualified personnel in these areas is extremely intense, especially for software developers with high levels of experience in designing and developing software products and sophisticated technical sales people experienced in selling our complex type of software product and selling into government agencies. In order to expand sales of EnCase^® Enterprise, we must continue to hire highly qualified commissioned sales personnel to directly target potential EnCase^® Enterprise customers. These new commissioned sales personnel require several quarters of training and experience before being able to

effectively market EnCase^® Enterprise, and, as a result of these hires, our sales and marketing expense will increase at a greater rate than our revenue, at least in the short term. The expense of hiring and training these commissioned sales personnel may never generate a corresponding increase in revenue. We may not be successful in attracting and retaining the necessary qualified personnel that our growth plan requires. We have from time to time in the past experienced, and we expect to continue to experience in the future, difficulty in hiring and retaining highly skilled employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we fail to attract new personnel or retain and motivate our current personnel, our business and future growth prospects could be severely harmed.

We also believe that a critical contribution to our successful rapid growth has been our corporate culture which fosters innovation, teamwork and excellence. As our organization grows and we are required to implement more complex organizational structures and institutional programs, we may find it difficult to maintain the beneficial aspects of our corporate culture, which could negatively affect our ability to attract and retain qualified and experienced personnel and therefore our future success in continuing to maintain our rapid growth.

Our failure to offer high quality training and to attract and retain high quality training personnel could have a material adverse affect on our sales of software applications and therefore have a negative impact on our business, financial condition and results of operations.

Our services offerings include training programs designed to instruct current and potential customers on the proper process of conducting a competent digital investigation and the most efficient operation of our products. To a significant degree, the pool of potential users of our products is created by the training services we and our partners provide. A high level of training is critical for the successful marketing, sale and implementation of our software products. Finding qualified third-party providers of training services for our complex software products is difficult and time-consuming, and to date we have approved only five such providers. If we or our partners do not effectively train our customers to properly use our software applications, or succeed in helping our customers quickly resolve post-deployment issues, it would adversely affect our ability to sell additional software products to existing customers in the future and could harm our reputation with potential customers of software products. As a result, our failure to attract and maintain high quality training representatives and personnel would have a material adverse effect on our sales of software applications and therefore negatively impact our business, financial condition and results of operations.

Our software applications may be perceived as, or determined by the courts to be, a violation of privacy rights. Any such perception or determination could adversely affect our revenues and results of operations.

Because of the nature of digital investigations, our potential customers and purchasers of our products or the public in general may perceive that use of our products for these investigations result in violations of individual privacy rights. In addition, certain courts and regulatory authorities could determine that the use of our software solutions or similar products are a violation of privacy rights, particularly in jurisdictions outside of the United States. Any such determination or perception by potential customers, the general public or the judicial system could harm our reputation and adversely affect the sales of our products and our results of operations.

Our business could be adversely affected based on the fact we are required to enter into United States General Services Administration Contracts with federal government agencies that purchase our products and services, which require that we provide our best corporate prices to the government agencies and give the government agencies the right to conduct administrative audits of our performance under such General Services Administration Contracts. As a result, we may be required to reimburse the United States government for costs that they have expended under such contracts, and our ability to bid and compete for future contracts with government agencies may be materially impaired.

When we sell our products and services to federal government agencies, we are required to enter into United States General Services Administration Contracts in connection with the sale of such products and services. These General Services Administration Contracts are intended to facilitate efficient sales to government agencies

and require that we provide the government agencies with “most-favored nation” type pricing with respect to sale of our products and services to the government agencies on a comparable basis with sales to other third parties. In addition, government agencies which purchase our products and services pursuant to General Services Administration Contracts are permitted to conduct administrative audits of us as part of their routine audits and investigations of government contracts. For example, the General Services Administration conducted an audit of Guidance in 2005 and issued to us an administrative report card with a rating of “successful.” As part of the audit process, the government agency may review our performance under the contract, cost structure, including the cost of comparable products and services to third parties, and compliance with applicable laws, regulations and standards. These government agencies may also review the adequacy of, and our compliance with, our internal controls systems and policies, including our purchasing, property, estimating, compensation and management information systems. If any of our pricing is found to be improperly discounted to a specific contract, the revenue received by us may have to be refunded and an additional penalty may have to be paid by us. A future audit with unfavorable results could materially affect our competitive position and result in a material adjustment to our financial results or statement of operations. In addition, if a government agency audit uncovers improper or illegal activities on our part, we may be subject to civil and criminal penalties and administrative sanctions, including, but not limited to, termination of existing contracts, forfeiture or disgorgement of profits, suspension of future payments owed, fines and suspension or debarment from doing business with the federal government or agencies thereof in the future. Furthermore, our reputation could suffer serious or irreparable harm if allegations of impropriety were levied against us. If we were suspended or debarred from contracting with the federal government or its agencies generally, or if our reputation or relationships with such agencies were impaired, or if the federal government otherwise ceased doing business with us or significantly decreased the amount of business it does with us, our revenues and prospects would be materially harmed.

Our business could be adversely affected by significant changes in the contracting or fiscal policies of governments and governmental entities.

We derive a portion of our revenues from contracts with federal, state, local and foreign governments and government agencies, and we believe that the success and growth of our business will continue to depend on our successful procurement of government contracts. Accordingly, changes in government contracting policies or government budgetary constraints could directly affect our business, financial condition and results of operations. Among the factors that could adversely affect our business, financial condition or results of operations are:

These and other factors could cause governments and governmental agencies to refrain from purchasing the products and services that we offer in the future, the result of which could have an adverse effect on our business, financial condition and results of operations. In addition, many of our government customers are subject to stringent budgetary constraints. The award of additional contracts from government agencies could be adversely affected by spending reductions or budget cutbacks at government agencies that currently use or are likely to utilize our products and services.

Because we offer our EnScript^® programming language for customization and add-ons to our EnCase^® software, customers or third-party programmers may be able to develop products which compete with our products or reduce the marketability or value of our products.

We have developed many of our major products, including our EnCase^® eDiscovery Suite and our Automated Incident Response Suite, to function as applications running on the EnCase^® Enterprise platform. We created these applications using the EnScript^® programming language. In order to enhance the attractiveness of our EnCase^® software to potential customers and position EnCase^® software as a standard software for digital investigations, we have made available without charge the EnScript^® programming language, which permits users of EnCase^® software to develop customized add-on features for their own or others’ use, and we have trained our customers on how to write add-on programs using the EnScript^® programming language, which is similar to C++. As part of this strategy, we have encouraged the development of an active community of EnScript^® programmers similar to those which have emerged for other software products. While we believe widespread use of our EnScript^® programming language will ultimately create demand for our products, customers in the past have developed, and may in the future develop, software for use with EnCase^® software using the EnScript^® programming language, rather than purchasing certain of our product offerings. Losses of sales to potential customers could have a material adverse impact on our revenues and results of operations.

Our success depends in part upon our ability to develop new products and enhance our existing products. Failure to successfully introduce new or enhanced products to the market may adversely affect our business, financial condition and results of operations.

Our future success depends in part on our ability to develop enhancements to our existing products and to introduce new products that keep pace with rapid technological developments and changes in customers’ needs. Although our products are designed to operate on a variety of network hardware and software platforms, we must continue to modify and enhance our products to keep pace with changes in network platforms, operating systems, software technology and changing customer demands. We may not be successful in developing and documenting these modifications and enhancements or in bringing them to market in a timely manner. Any failure of our products to operate effectively with future network platforms and technologies could reduce the demand for our products and result in customer dissatisfaction. In addition, the next version of our products will incorporate document viewer technology that we license from Stellent, Inc. We may be unable to replace this technology if it becomes obsolete or incompatible with our products.

Furthermore, any new products that we develop may not be released in a timely manner and may not achieve the market acceptance necessary to generate significant sales revenues. As a result, we may expend significant time and expense towards research and development for new or enhanced products, which may not gain market acceptance or generate sufficient sales to offset the costs of research and development. If we are unable to successfully develop new products or enhance and improve our existing products, or if we fail to position or price our products to meet market demand, our business, financial condition and results of operations will be adversely affected.

Errors in our products could adversely affect our reputation, result in significant costs to us, impair our ability to market our products and expose us to legal liability, any of which may adversely affect our operating results.

Products as complex as ours often contain undetected errors or failures. Despite extensive testing by us and by our customers, we have in the past discovered errors in our software applications and will likely continue to do so in the future. As a result of past discovered errors, we experienced delays and lost revenues while we corrected the problems in those software applications. In addition, customers in the past have brought to our attention “bugs” in our software exposed by the customers’ unique operating environments. Although we have been able to fix these software bugs in the past, we may not always be able to do so in the future. In addition, our products may also be subject to intentional attacks by viruses that seek to take advantage of these bugs, errors or other weaknesses. Any of these events may result in the loss of, or delay in, market acceptance of our products and services, which would seriously harm our sales, financial condition and results of operations.

Furthermore, we believe that our reputation and name recognition are critical factors in our ability to compete and generate additional sales of our products and services. Promotion and enhancement of our brand name will depend largely on our success in continuing to provide effective software applications and services. The occurrence of errors in our software applications or the detection of bugs by our customers may damage our reputation in the market as well as our relationships with existing customers, which may result in our inability to attract or retain customers.

In addition, because our products are used in security and forensic functions that are often critical to our customers, the licensing and support of our products makes us potentially subject to product liability claims. Any product liability insurance we carry may not be sufficient to cover our losses resulting from any such product liability claims. The successful assertion of one or more large product liability claims against us could have a material adverse effect on our financial condition.

Incorrect or improper use of our products, our failure to properly train customers on how to utilize our software products or our failure to properly provide consulting and implementation services could result in negative publicity and legal liability.

Our products are complex and are deployed in a wide variety of network environments. The proper use of our software requires extensive training by the end user and, if our software products are not used correctly or as intended, inaccurate results may be produced. Our customers or our professional services personnel may incorrectly implement or use our products. Our products may also be intentionally misused or abused by customers or non-customer third parties who obtain access and use of our products. Because our customers rely on our product and service offerings to manage a wide range of sensitive investigations and security functions, the incorrect or improper use of our products, our failure to properly train customers on how to efficiently and effectively use our products or our failure to properly provide consulting and implementation services to our customers may result in negative publicity or legal claims against us.

We cannot predict our future capital needs and we may be unable to obtain additional financing to develop new products, enhance existing products, offer additional services or fund strategic acquisitions, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

We may need to raise additional funds in the future in order to develop new products, enhance existing products, offer additional services or make strategic acquisitions of complementary businesses, technologies, products or services. Any required additional financing may not be available on terms acceptable to us, or at all. If we raise additional funds by issuing equity securities, you will experience dilution of your ownership interest, which could be significant, and the newly-issued securities may have rights senior to those of the holders of our common stock. If we raise additional funds by obtaining loans from third parties, the terms of those financing arrangements may include negative covenants or other restrictions on our business that could impair our operational and financial flexibility and would also require us to incur additional interest expense. If additional financing is not available when required or is not available on acceptable terms, we may be unable to successfully develop or enhance our software products and services through internal research and development or acquisitions in order to take advantage of business opportunities or respond to competitive pressures, which could negatively impact our software products and services offerings and sales revenues, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

Acquisitions that we may undertake in the future involve risks that could adversely affect our business, financial condition and results of operations.

We may pursue strategic acquisitions of businesses, technologies, products or services that we believe complement or expand our existing business, products and services. Acquisitions involve numerous risks, including, but not limited to, the following:

To date, we have not completed an acquisition. Any acquisitions of businesses, technologies, products or services that we may undertake in the future may not generate sufficient revenues or cost-saving synergies necessary to offset the associated costs of the acquisitions or may result in other material adverse effects.

Our international sales and operations are subject to factors that could have an adverse effect on our business, financial condition and results of operations.

We have significant sales and services operations outside the United States, and derive a substantial portion of our revenues from these operations. We also plan to expand our international operations in the future. For the fiscal year ended December 31, 2005, we derived approximately 25% of our revenues from sales of products and services outside the United States.

Our international operations are subject to risks related to the differing legal, political, social and regulatory requirements and economic conditions of many countries, which risks include, but are not limited to:

We may not continue to succeed in developing and implementing policies and strategies that will be effective in each location where we currently do business or intend to do business in the future. Furthermore, the occurrence of any of the foregoing factors may have a material adverse effect on our business, financial condition and results of operations.

An active market for our common stock may not develop, which may limit the ability of our stockholders to sell common stock following this offering.

An active or liquid trading market in our common stock may not develop upon completion of this offering, or if it does develop, it may not continue. If an active trading market does not develop, you may have difficulty selling any of our common stock that you buy in this offering. The initial public offering price of our common stock will be determined through our negotiations with the underwriters and may be higher than the market price of our common stock after the closing of this offering. Consequently, you may not be able to sell shares of our common stock that you purchase in this offering at prices equal to or greater than the price paid by you in the offering. See “Underwriters” for a discussion of the factors that we and the underwriters will consider in determining the initial offering price of our common stock to the public.

The price of our common stock may be highly volatile and may decline regardless of our operating performance.

The market price of our common stock could be subject to significant fluctuations in response to:

The market prices of common stock of software companies have been extremely volatile. Stock prices of many software companies have often fluctuated in a manner unrelated or disproportionate to the operating performance of such companies. In the past, following periods of market volatility, stockholders have often instituted securities class action litigation relating to the stock trading and price volatility of the software company in question. If we were involved in any securities litigation, it could result in substantial cost to us to defend and divert resources and the attention of management from our business.

Current and potential shareholders will experience immediate and substantial dilution in the net tangible book value of the common shares you purchase in this offering.

If you purchase shares of our common stock in this offering, you will experience immediate and substantial dilution of $ per share based on an assumed offering price of $ per share, the midpoint of the estimated price range shown on the cover page of this prospectus, because the price that you pay will be substantially greater than the net tangible book value per share of the shares you acquire. This dilution is due in large part to the fact that our earlier investors paid substantially less than the initial public offering price when they purchased their shares. You will experience additional dilution upon the exercise of outstanding stock options. As of August 31, 2006, options exercisable for an aggregate of approximately 980,075 shares of our common stock at an average exercise price of $4.58 per share were outstanding.

Future sales of our common stock, or the perception that such future sales may occur, may cause our stock price to decline and impair our ability to obtain capital through future stock offerings.

A substantial number of shares of our common stock could be sold into the public market after this offering. The occurrence of such sales, or the perception that such sales could occur, could materially and adversely affect our stock price and could impair our ability to obtain capital through an offering of equity securities in the future. The shares of common stock being sold in this offering will be freely tradable, except for any shares sold to our affiliates.

In connection with this offering, all members of our senior management, our directors and substantially all of our stockholders and option holders have entered into written “lock-up” agreements providing in general that, for a period of 180 days from the date of this prospectus, they will not, among other things, sell their shares without the prior written consent of Morgan Stanley & Co. Incorporated. However, these lock-up agreements are subject to a number of specified exceptions. See “Shares Eligible for Future Sale—Lock-up Agreements” and “Underwriters” for more information regarding these lock-up agreements. Upon the expiration of the lock-up period, all outstanding shares of our common stock will be tradable in the public market subject, in most cases, to volume and other restrictions under federal securities laws.

The concentration of our capital stock ownership with insiders upon the completion of this offering will likely limit your ability to influence corporate matters.

We anticipate that our executive officers, directors and affiliated entities will together beneficially own approximately % of our common stock outstanding after this offering, including % of our outstanding common stock held by our founder, Shawn McCreight, and his wife. As a result, these stockholders will have control over matters that require approval by our stockholders, including the election of directors and approval of significant corporate transactions. Corporate actions favored by these shareholders might be taken even if other stockholders, including those who purchase shares in this offering, oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control that other stockholders may view as beneficial.

Our management will have broad discretion over the use of the proceeds to us from this offering and might not apply the proceeds of this offering in ways that increase the value of your investment.

Our management will have broad discretion to use the net proceeds from this offering, and you will be relying on the judgment of our management regarding the application of these proceeds. Our management might not apply the net proceeds of this offering in ways that increase the value of your investment. We expect to use a portion of the net proceeds from this offering for general corporate purposes, including working capital and capital expenditures, a final S Corporation distribution and for possible investments in, or acquisitions of, complementary businesses, technologies, products or services. We have not allocated these net proceeds for any specific purposes. We might not be able to yield a significant or any return on any investment of these net proceeds.

Certain provisions in our charter documents and Delaware law may inhibit potential acquisition bids for Guidance Software and prevent changes in our management.

Effective upon the closing of this offering, our Delaware certificate of incorporation and bylaws will contain provisions that could depress the trading price of our common stock by acting to discourage, delay or prevent a change of control or changes in the management or board of directors that our stockholders might deem advantageous. Specific provisions in our certificate of incorporation may include:

As a result of these and other provisions in our certificate of incorporation, the price investors may be willing to pay in the future for shares of our common stock may be limited.

In addition, prior to the completion of this offering, we will be subject to Section 203 of the Delaware General Corporation Law, which will impose certain restrictions on mergers and other business combinations between us and any holder of 15% or more of our common stock. Further, certain of our agreements with our executive officers and incentive plans, including our Executive Retention and Severance Plan, provide for vesting of stock options and/or payments to be made to the employees thereunder if their employment is terminated in connection with a change of control, which could discourage, delay or prevent a merger or acquisition at a premium price. At December 31, 2005 total severance obligations in connection with the Executive Retention and Severance Plan amounted to $1,740,000. See “Management—Employment Agreements,” “Management—Executive Retention and Severance Plan” and “Description of Capital Stock—Delaware Anti-Takeover Law and Certain Provisions of our Certificate of Incorporation and Bylaws.”

After the completion of this offering we do not anticipate paying any cash dividends to holders of our common stock in the foreseeable future. Consequently, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investment. Investors seeking cash dividends should not purchase our common stock.

As a public company, we will incur significant legal, accounting and other expenses that we did not incur as a private company. The Securities Exchange Act of 1934, the Sarbanes-Oxley Act of 2002 and NASDAQ rules promulgated in response to the Sarbanes-Oxley Act regulate corporate governance practices of public companies. We expect that compliance with these public company requirements will increase our costs and make some activities more time-consuming. For example, we have recently created new board committees and have adopted new internal controls and disclosure controls and procedures. In addition, we will incur additional expenses associated with our SEC reporting requirements. A number of those requirements will require us to carry out activities we have not done previously. For example, under Section 404 of the Sarbanes-Oxley Act, for our annual report on Form 10-K for the first full fiscal year after the completion of this offering, we will need to document and test our internal control procedures, our management will need to assess and report on our internal controls over financial reporting and our registered public accounting firm will need to issue an opinion on that assessment and the effectiveness of those controls. Furthermore, if we identify any issues in complying with those requirements (for example, if we or our registered public accounting firm identify a material weakness or significant deficiency in our internal controls over financial reporting), we could incur additional costs rectifying those issues, and the existence of those issues could adversely affect us, our reputation, investor perceptions of us and the price of our common stock.

We also expect that it will be difficult and expensive to obtain additional director and officer liability insurance, and we may be required to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. As a result, it may be more difficult for us to attract and retain qualified persons to serve on our board of directors or as executive officers. Advocacy efforts by stockholders and third parties may also prompt even more changes in governance and reporting requirements. We cannot predict or estimate the amount of additional costs we may incur or the timing of such costs.

This prospectus, including particularly the sections entitled “Prospectus Summary,” “Risk Factors,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and “Business,” contains forward-looking statements. In particular, statements regarding our plans, strategies, prospects and expectations regarding our business are forward-looking statements. These statements relate to future events or our future financial performance and involve known and unknown risks, uncertainties and other factors that may cause our actual results, levels of activity, performance or achievements to differ materially from any future results, levels of activity, performance or achievements expressed or implied by these forward-looking statements. These risks, uncertainties and other factors include, among others:

Forward-looking statements include all statements that are not historical facts. In some cases, you can identify forward-looking statements by terminology such as “anticipates,” “believes,” “continue,” “estimates,” “expects,” “intends,” “may,” “plans,” “potential,” “predicts,” “should,” “could,” “would,” “will” or the negative of these terms or other comparable terminology. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee future results, levels of activity, performance or achievements. Accordingly, you should not place undue reliance on the forward-looking statements contained in this prospectus. Except as required by law, we undertake no obligation to update or revise publicly any forward-looking statements, whether as a result of new information, future events or otherwise after the date of this prospectus. You should be aware that the Private Securities Litigation Reform Act of 1995 and Section 27A of the Securities Act of 1933, as amended, do not exempt from liability any forward-looking statements that we make in connection with this offering.

This prospectus contains statistical data that we obtained from industry publications and other industry sources, including reports generated by Socha Consulting LLC and Gelbmann & Associates, International Data Corporation, Fulbright & Jaworski LLP and other third parties. These industry publications generally indicate that they have obtained their information from sources believed to be reliable, but the sources do not guarantee the accuracy and completeness of their information. We have not independently verified their data. You should read this prospectus and the documents that we reference in this prospectus and have filed as exhibits to the registration statement, of which this prospectus is a part, completely and with the understanding that our actual future results may be materially different from what we expect. We qualify all of our forward-looking statements by these cautionary statements.

We estimate that the net proceeds from the sale of shares by us in the offering (based on an offering price of $ per share, the midpoint of the estimated price range shown on the cover page of this prospectus), after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us, will be $ million. If the underwriters’ over-allotment option is exercised in full, we estimate that our net proceeds will be approximately $ million. We will not receive any proceeds from the sale of common stock by the selling stockholders. Some members of our senior management are selling shares in the offering. See “Principal and Selling Stockholders.”

We intend to use a portion of the net proceeds from this offering together with our existing cash balances to fund a final distribution to our existing pre-IPO stockholders. The final distribution will be in an amount equal to the sum of (i) our paid-in capital as of the date of the declaration of our final distribution and (ii) our undistributed accumulated S Corporation net income. The paid-in capital to be distributed is equal to the aggregate amount of cash and the fair market value of other property previously contributed or paid to us by our existing stockholders in consideration for their stock. We estimate that the amount of this distribution will be approximately $ million. See “S Corporation Status.” We anticipate that we will use the remainder of the net proceeds of this offering for general corporate purposes, including working capital, capital expenditures and potential acquisitions of complementary businesses, products and technologies. We have no current agreements or commitments with respect to any such acquisitions. Pending these uses, we intend to invest the net proceeds in high quality, investment grade U.S. government-backed obligations. The actual use of the proceeds may vary significantly and will depend on a number of factors, including our future revenue and cash generated by operations and the other factors described in the section entitled “Risk Factors” appearing elsewhere in this prospectus. Accordingly, our management will have broad discretion in applying the net proceeds of this offering.

As an S Corporation, we have made distributions to our stockholders since October 1998 as necessary to cover taxes. We anticipate that we will pay a final distribution of approximately $ million (the actual final distribution could be higher or lower) to our existing pre-IPO stockholders upon the completion of this offering. We anticipate that any future earnings will be retained to finance continuing development of our business. We therefore do not anticipate paying any cash dividends on our common stock in the foreseeable future. Our future decisions concerning the payment of dividends on our common stock will depend upon our results of operations, financial condition and capital expenditure plans, as well as any other factors that the board of directors, in its sole discretion, may consider relevant.

From our incorporation through September 1998, we were treated as a “C Corporation” under Subchapter C of the Internal Revenue Code of 1986 (“the Code”). In October 1998 we elected to be treated for federal income tax purposes as an “S Corporation” under Subchapter S of the Code. In addition, we have elected or are otherwise treated as an S Corporation for certain state tax purposes. As a result, from October 1998 (for federal income tax purposes) and the day we elected or were otherwise treated as an S corporation (for state income tax purposes) through the completion of this offering, our earnings have been and will be included in the income of our stockholders for federal and certain state income tax purposes, and we have been subject only to reduced state income tax on such earnings. Since October 1998 we have paid distributions to our stockholders as necessary to cover taxes. At least one day prior to the pricing of this offering, we will terminate our S Corporation status and, as a result, from and after such date, we will be subject to state and federal corporate income taxes.

We have agreed to declare certain distributions to our existing pre-IPO stockholders prior to the pricing of this offering. Purchasers of shares in the offering will not receive any of these distributions. The distributions will be in an amount generally equal to the sum of (i) our paid-in capital as of the date of the declaration of our final distribution and (ii) our net income includible in our current stockholders’ income as a result of our S Corporation status for all of our taxable periods starting in October 1998 and ending on the day prior to the day that our status as an S Corporation terminates, less distributions previously made to our current stockholders with respect to such net income. The determination of our net income for the taxable period commencing on January 1, 2006 through the day prior to the day on which our status as an S Corporation terminates will be based on our good faith estimate of our 2006 net earnings and income realized during such period. If our actual net income, as finally determined, is greater than such estimate, we have agreed, pursuant to the tax matters agreement entered into by us and our current stockholders, to pay such excess to our current stockholders. If our actual net income is less than such estimate, our current stockholders will not be required to pay such excess to us. The aggregate final distribution currently is estimated to be $ million, but the actual amount could be higher or lower depending on the actual aggregate amount of our 2006 earnings as of the completion of this offering.

We expect that our 2006 earnings and income taken into account for purposes of calculating the final distribution may or may not be greater than our net income calculated in accordance with generally accepted accounting principles (“GAAP”) primarily due to the inclusion of certain revenues in our taxable income that are deferred under GAAP.

If our S Corporation election was not properly made and maintained, we would be liable for federal and state income tax since October 1, 1998, together with interest thereon and, possibly, penalties. Such taxes and penalties would likely be material to our operating results. We believe, however, that our S Corporation election was properly made and has been properly maintained and, accordingly, that we will not be required to pay such taxes, interest, or penalties. Pursuant to the tax matters agreement, we have also agreed to indemnify and hold harmless our existing pre-IPO S Corporation stockholders in certain circumstances for increases in their tax liability for the periods during which we were an S Corporation.

The following table sets forth our unaudited cash and cash equivalents and capitalization as of June 30, 2006:

You should read this table together with the discussion under the heading “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” “Description of Capital Stock” and our consolidated financial statements and the related notes appearing elsewhere in this prospectus.

If you invest in our common stock in this offering, your ownership interest will be diluted to the extent of the difference between the initial public offering price per share of our common stock and the pro forma as adjusted net tangible book value per share of our common stock immediately after the completion of this offering.

The net tangible book value of our common stock at June 30, 2006 was approximately $(4,189) million, or $(0.23) per share. The pro forma as adjusted net tangible book value of our common stock as of June 30, 2006 was approximately $ million, or $ per share. Pro forma net tangible book value per share represents total tangible assets reduced by the amount of total liabilities, divided by the number of shares of common stock outstanding, after giving effect to the recording of a net deferred tax asset of $ million arising from the termination of our S Corporation status and the final distribution of $ million to be paid to our existing pre-IPO stockholders in connection with the termination of our S Corporation status. Dilution in pro forma as adjusted net tangible book value per share represents the difference between the amount per share paid by purchasers of shares of common stock in this offering and the pro forma as adjusted net tangible book value per share of common stock immediately after the completion of this offering.

After giving effect to the sale of shares of common stock in this offering at an assumed public offering price of $ , the midpoint of the estimated price range shown on the cover page of this prospectus, and after deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us, our pro forma as adjusted net tangible book value as of June 30, 2006 would have been $ million, or approximately $ per share. This represents an immediate increase in pro forma as adjusted net tangible book value of $ per share to existing stockholders and an immediate dilution of $ per share to new investors. The following table illustrates this per share dilution:

The following table presents, on a pro forma as adjusted basis, as of June 30, 2006, the differences among the number of shares of common stock purchased from us, the total consideration paid or exchanged, or to be paid, and the average price per share paid by existing stockholders and by new investors purchasing shares of our common stock in this offering before deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us. The table assumes an initial public offering price of $ per share, as specified above, and deducts the estimated underwriting discounts and commissions and estimated offering expenses payable by us:

The foregoing tables and calculations assume exercise of warrants to purchase 206,200 shares of our common stock and no exercise of the underwriters’ option to purchase additional shares and excludes:

The following selected consolidated financial data should be read together with “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes appearing elsewhere in this prospectus. The selected consolidated balance sheet data as of December 31, 2004 and 2005 and the selected consolidated statement of operations data and non-cash compensation data for each of the three years in the period ended December 31, 2005, have been derived from our audited consolidated financial statements, which appear elsewhere in this prospectus. The selected consolidated balance sheet data as of December 31, 2002 and 2003 and selected consolidated statement of operations data and non-cash compensation data for the year ended December 31, 2002 have been derived from our audited consolidated financial statements not included in this prospectus. The selected consolidated balance sheet data as of December 31, 2001, and the selected consolidated statement of operations for the year then ended have been derived from our unaudited consolidated financial statements not included in this prospectus. The selected consolidated statements of operations data and non-cash compensation data for the six month periods ended June 30, 2005 and 2006 and the selected consolidated balance sheet data as of June 30, 2006, have been derived from our unaudited consolidated financial statements appearing elsewhere in this prospectus. This information is unaudited but, in management’s opinion, has been prepared on the same basis as the audited consolidated financial statements and related notes included elsewhere in this prospectus and includes all adjustments, consisting only of normal recurring adjustments, that our management considers necessary for a fair presentation of the information for the periods presented. Historical results are not necessarily indicative of the results to be expected in the future, and the results for the six months ended June 30, 2006, should not be considered indicative of results expected for the full fiscal year. The pro forma net income data below is unaudited and has been calculated to reflect the taxes that would have been reported had we been subject to federal and state income taxes as a C Corporation for the periods presented.

MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS

You should read the following discussion and analysis along with our consolidated financial statements, the related notes to such statements and the other financial information included elsewhere in this prospectus. This discussion contains forward-looking statements that involve risks and uncertainties. Actual results could differ materially from those discussed below; accordingly, investors should not place undue reliance upon our forward-looking statements. See “Risk Factors” and “Forward-Looking Statements” for a discussion of these risks and uncertainties.

We develop and provide the leading software solutions for digital investigations, including EnCase^® Enterprise, a network-enabled product primarily for large corporations and government agencies, and EnCase^® Forensic, a desktop-based product primarily for law enforcement agencies. We were incorporated and commenced operations in 1997. From 1997 through 2002, we generated a substantial portion of our revenues from the sale of our EnCase^® Forensic products and related services. Between 2003 and 2005, after the release of our EnCase^® Enterprise products and related services, our revenues were driven by the sales of both our EnCase^® Forensic products and our EnCase^® Enterprise products and related services.

We have experienced increases in our revenue as a result of the release of our EnCase^® Enterprise products in late 2002, which expanded our customer base into corporate enterprises and federal government agencies. The release of our eDiscovery Suite in late 2005 has increased our average transaction size, although the number of eDiscovery Suite transactions has been limited. On an ongoing basis, we anticipate that sales of our EnCase^® Enterprise products and related services, in particular our eDiscovery Suite solution, will comprise a substantial portion of our future revenues.

Our revenues are classified into two types: product revenue and services and maintenance revenue.

Product Revenue. We generate product revenue principally from sales of our EnCase^® Enterprise and EnCase^® Forensic products. Substantially all of the EnCase^® Enterprise and EnCase^® Forensic license agreements that we have entered into are perpetual in license term. In conjunction with our EnCase^® Forensic software, we also sell our Premium License Support Program product, which is sold on a subscription basis for a term of several years.

Services and Maintenance Revenue. Services revenue is comprised of revenue from professional services and training. Professional services is comprised of consulting services and implementation services. Consulting services are typically billed on a per hour or per disk drive basis or are provided under fixed fee arrangements depending on the scope and size of each individual project. Implementation services are generally included with the purchase of a software license. Training services include a broad range of training course offerings on the general principals of computer forensics and how to use our EnCase^® software products. Training services are typically billed on a per person, per class basis.

Maintenance services represent technical support services for our software solutions and include the right to unspecified product upgrades on a when-and-if available basis. Maintenance services are generally included in the sale of a perpetual license and typically are provided for a period of one year. Upon the expiration of our maintenance contracts, our customers have the right to purchase maintenance contract renewals, which generally cover a period of one year. We also offer maintenance contract renewal options for up to a three-year period.

Cost of Revenues. Cost of product revenue consists principally of compensation and related overhead expenses for employees engaged in the distribution of our products, and the cost of producing and shipping our

software, including the cost of compact discs, packaging and freight, and our FastBloc^® hardware. Cost of services and maintenance revenue consists of customer support costs, training expenses and professional services expenses, including compensation and related overhead expenses. Cost of revenues in 2006 also includes share-based compensation allocable to production and service personnel.

As our client base and solution usage grows, we intend to continue to invest additional resources in technical support and professional services.

Selling and Marketing Expenses. Selling and marketing expenses consist primarily of base compensation and related overhead expenses for employees engaged in selling and marketing. Selling and marketing expenses also include sales commissions and expenses relating to advertising, brand building, marketing and trade show events, product management, travel and allocated overhead. Selling and marketing expenses in 2006 also include share-based compensation allocable to selling and marketing personnel.

Although we expense our sales commissions at the time the related sale is invoiced to the client, revenues from our EnCase^® Forensic product, Premium License Support Program and consulting, maintenance and implementation are recognized over the relevant performance or license period. Accordingly, we generally experience a delay between increased selling and marketing expenses and the recognition of a portion of the corresponding revenue.

We expect significant increases in selling and marketing expenses as we hire additional selling and marketing personnel and increase the level and scope of our selling activities.

Research and Development Expenses. Research and development expenses consist primarily of compensation and related overhead expenses for research and development personnel, translation fees, quality assurance and testing. Research and development expenses in 2006 also include share-based compensation allocable to research and development personnel.

We expect that research and development expenses will increase as we seek to expand our technology and product offerings.

General and Administrative Expenses. General and administrative expenses consist of compensation and related overhead expenses for personnel engaged in the accounting, legal, information systems, human resources and other administrative functions. In addition, it includes professional service fees, other corporate expenses and related overhead. General and administrative expenses also include share-based compensation allocable to general and administrative personnel.

We anticipate that we will incur additional employee compensation and related overhead expenses, professional service fees and insurance costs related to the growth of our business and operations and the transitioning of our business to meet the requirements of a public company.

There are a number of trends that may affect our business and our industry. Some of these trends or other factors include:

Effective internal controls are necessary for us to provide reliable financial reports and effectively prevent fraud. If we cannot provide reliable financial reports or prevent fraud, our operating results could be misstated and our reputation may be harmed. In connection with the audit of our financial statements for the year ended December 31, 2005, in July 2006, our independent registered public accounting firm, reported to our audit committee several matters that are “material weaknesses” in our internal controls as defined by the standards established by the Public Company Accounting Oversight Board. In addition, in June 2005, in connection with their audit of our financial statements for the year ended December 31, 2004, our previous independent registered public accounting firm reported “material weaknesses” in our internal controls as defined by the standards established by the Public Company Accounting Oversight Board. A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected.

The material weaknesses reported by our independent registered public accounting firm in connection with their audit of our financial statements for the year ended December 31, 2005, are summarized below:

The material weaknesses reported by our previous independent registered public accounting firm in connection with their audit of our financial statements for the year ended December 31, 2004, are summarized below:

These material weaknesses may have contributed to the errors corrected in the restatement of our financial statements for the year ended December 31, 2004 and prior years. See “Accounting Restatements.”

As a result of the previously identified material weaknesses, we took the actions described below. Given that our remediation efforts continue, these actions also serve as additional procedures and analyses to ensure that our consolidated financial statements are prepared in accordance with generally accepted accounting principles in the United States of America.

Through these actions we have begun our remediation efforts and we believe that these actions have strengthened our internal controls over financial reporting. Although initiated, our plan to improve the effectiveness of our internal controls and processes is not complete.

In addition to those steps already taken, to address the material weaknesses identified above, we are evaluating new general ledger software solutions to meet the demands of our growing business as well as the need for additional changes to our control environment.

While we have made certain progress with respect to remediating the material weaknesses described above, it will take some time to put in place the rigorous disclosure controls and procedures desired by our management and our board of directors. We cannot at this time estimate how long it will take to complete the steps identified above. Our management will continue to evaluate the effectiveness of the control environment and will continue to refine existing controls. We cannot assure you that the measures we have taken to date or any future measures will remediate the material weaknesses reported by our independent registered public accounting firms. Our current independent registered public accounting firm has not evaluated the measures we have taken or plan to take to address the material weaknesses described above. For a description of risks associated with our internal controls, please see “Risk Factors—If we fail to develop or maintain an effective system of internal controls, we may not be able to accurately report our financial results or prevent fraud. As a result, current and potential shareholders could lose confidence in our financial reporting, which would harm our business and the trading price of our common stock.”

In addition, during 2004, we incorrectly applied the provisions of Statements of Financial Accounting Standards (“SFAS”) No. 86, “Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise Marketed.” Specifically, we capitalized software development costs that should have been expensed. Our restated 2004 consolidated financial statements reflect an additional $386,000 of research and development expense which had previously been capitalized. Our 2003 balance sheet was restated to recognize real property leasehold incentives that previously were not accounted for in our financial statements. This restatement resulted in an increase to total assets and total liabilities of $552,000 to our 2003 consolidated balance sheet. This did not result in an impact to our income statement for the year ended December 31, 2003.

We also determined that we did not properly record expenses in the year incurred and we did not properly recognize certain other assets and accounts payable. This restatement resulted in an increase to net loss of $63,000 and $15,000 in 2004 and 2003, respectively, and a decrease in net loss of $168,000 in 2003.

The net effects of the restatements on previously reported accumulated deficit as of January 1, 2003 and net income (loss) for 2002, 2003 and 2004 by the nature of the adjustment are as follows:

For a description of risks associated with our financial statement restatement, please see “Risk Factors—We face risks related to our accounting restatements.”

The fair value of our securities in the 18 months prior to June 30, 2006 was determined based on contemporaneous valuations performed by an unrelated valuation specialist. Determining the fair value of our stock requires making complex and subjective judgments. Our approach to valuation is based on a combination of the discounted future cash flow approach (“Income Approach”) and guideline public company method (“Market Approach”). The Income Approach uses our estimates of revenues, driven by assumed market growth rates, and estimated costs as well as appropriate discount rates. These estimates are consistent with the plans and estimates that we use to manage the business. The Market Approach is predicated on recent sales of comparable assets in the marketplace and depends upon publicly traded shares of similar public companies. Based on an initial public offering price of $ , the midpoint of the range set forth on the cover of this prospectus, the intrinsic value of the options outstanding at June 30, 2006 was $ million, of which $ million related to vested options and $ million related to unvested options.

Prior to January 1, 2006, we accounted for the stock options granted under our 2004 Equity Incentive Plan by applying the intrinsic value-based method of accounting prescribed by Accounting Principles Board Opinion No. 25 (“APB 25”), “Accounting for Stock Issued to Employees.” Under this method, compensation expense is generally recorded only if the fair value of the underlying stock exceeded the exercise price on the date of grant. We adopted the disclosure-only requirements of the Statement of Financial Accounting Standards (“SFAS”) No. 123 (“SFAS 123”) “Accounting for Stock-Based Compensation,” and SFAS No. 148 (“SFAS 148”), “Accounting for Stock-Based Compensation—Transition and Disclosure—an Amendment of FASB Statement No. 123.” These statements established accounting and disclosure requirements using a fair value-based method of accounting for stock-based employee compensation plans. As allowed by SFAS 123 and SFAS 148, we elected to continue to apply the intrinsic value-based method described above for stock options granted prior to January 1, 2006. Accordingly, no share-based compensation for stock options is recorded in the accompanying financial statements prior to January 1, 2006, as the fair-value of the underlying stock did not exceed the exercise price of the options at the date of grant.

Effective January 1, 2006, we adopted SFAS No. 123R (“SFAS 123R”) “Share-Based Payment.” Prior to the adoption of SFAS 123R, we used the minimum-value method afforded by SFAS 123 for disclosure purposes; therefore, as prescribed by SFAS 123R, we adopted SFAS 123R using the prospective transition method. Accordingly, prior period amounts have not been restated. Under this transition method, compensation cost for options granted prior to January 1, 2006 that vest after that date will continue to be accounted for based on the grant date intrinsic value of the option estimated in accordance with the provisions of APB 25. Since all of these options were granted at exercise prices that were equal to the fair market value of the underlying stock on the date of the grant, we will not recognize share-based compensation expense as these options continue to vest. All share-based payments granted subsequent to January 1, 2006 will be accounted for based on the grant date fair value estimated in accordance with the provisions of SFAS 123R. The fair market value of a share-based payment is estimated on the date of the grant using the Black-Scholes option pricing model, and is recognized as compensation expense over the vesting period.

As of June 30, 2006, there was $2.3 million of total unrecognized compensation cost related to nonvested stock-based compensation that is expected to be recognized over a weighted-average period of 3.75 years for grants subsequent to January 1, 2006. We expect to record approximately $593,000 in share-based compensation in the year ended December 31, 2006 related to options outstanding as of June 30, 2006.

On May 2, 2006, our founding stockholders contributed 2,062,000 common shares to us. The contribution was made as a result of a commitment by the founding stockholders, upon establishment of the 2004 Equity Incentive Plan, to fund the common shares underlying the initial 2,062,000 option grants. Upon receipt of the contribution, we retired the common shares. The contribution and related retirement is reflected as donated capital, retired in the consolidated statement of stockholders’ equity.

From our incorporation through September 1998, we were treated as a “C Corporation” under Subchapter C of the Code. In October 1998, we elected to be treated for federal income tax purposes as an “S Corporation” under Subchapter S of the Code. In addition, we have elected or are otherwise treated as an S Corporation for certain state tax purposes. As a result, from October 1998 (for federal income tax purposes) and the day we elected or were otherwise treated as an S corporation (for state income tax purposes) through the completion of this offering, our earnings have been included in the income of our stockholders for federal and certain state income tax purposes, and we have been subject only to reduced state income tax on such earnings. Since October 1998 we have paid distributions to our stockholders to pay their related tax obligations. We intend to terminate our S Corporation status effective one day prior to the pricing of this offering. From and after such date, we will be treated for federal and state income tax purposes as a C Corporation under Subchapter C of the Code and, as a result, will be subject to state and federal corporate income taxes.

We have agreed to declare a distribution to our existing pre-IPO stockholders prior to the pricing of this offering. Purchasers of shares in the offering will not receive any of this distribution. This distribution will generally be equal to the sum of (i) our paid-in capital as of the date of declaration of our final distribution and (ii) our federal net income includible in the income of our stockholders as a result of our S Corporation status for all of our taxable periods starting in October 1998 and ending on the day prior to the day our status as an S Corporation terminates, less distributions previously made to our current stockholders with respect to such net income. The aggregate final distribution currently is estimated to be $ million, but the actual amount could be higher or lower depending on the actual aggregate amount of our 2006 earnings as of the completion of this offering. The determination of our net income for the taxable period commencing on January 1, 2006 through the day prior to the day on which our status as an S Corporation terminates is based on our good faith estimate of our taxable earnings and income that is realized during such period. If our actual net income, as finally determined, is greater than such estimate, we have agreed, pursuant to the tax matters agreement entered into by us and our current stockholders, to pay such excess to our current stockholders. If our actual net income is less than such estimate, our current stockholders will not be required to reimburse such excess to us.

We expect that our 2006 earnings and income taken into account for calculating the final distribution will be greater than our net income calculated in accordance with GAAP primarily due to the inclusion of certain revenues in our taxable income that are deferred under GAAP.

If our S Corporation election was not properly made and maintained, we would be liable for federal and state income tax, together with interest thereon and, possibly, penalties for any period that we did not qualify as an S Corportion. Such taxes and penalties would likely be material to our operating results. We believe, however, that our S Corporation election was properly made and has been properly maintained and, accordingly, that we will not be required to pay such taxes, interest, or penalties. Pursuant to the tax matters agreement, we have also agreed to indemnify and hold harmless our pre-IPO S Corporation stockholders in certain circumstances for increases in their tax liability for the periods during which we were an S Corporation.

Our discussion and analysis of our financial condition and results of operations are based upon our financial statements, which have been prepared in accordance with generally accepted accounting principles in the United States of America. The preparation of these financial statements requires us to make estimates and judgments that affect the reported amounts of assets, liabilities, revenues and expenses, and related disclosure of contingent assets and liabilities. On an ongoing basis, we evaluate these estimates, including those related to bad debts, income taxes, commitments, contingencies and litigation. We base our estimates on historical experience and on various other assumptions that are believed to be reasonable under the circumstances. Actual results may differ from these estimates.

We consider the following accounting policies to be both those most important to the portrayal of our results of operations and financial condition and those that require the most subjective judgment:

We apply the provisions of SOP 97-2 and related interpretations. For arrangements that contain a non-software deliverable such as hardware, we apply the provisions of Emerging Issues Task Force (“EITF”) No. 03-05 “Applicability of AICPA Statement of Position 97-2 to Non-Software Deliverables in an Arrangement Containing More-Than-Incidental Software” and recognize revenue when all other revenue recognition criteria are met. While these statements govern the basis for revenue recognition, significant judgment and the use of estimates are required in connection with the allocation of revenue between product revenue and services and maintenance revenue, as well as the amount of deferred revenue to be recognized in each accounting period.

Product Revenue. The timing of product revenue recognition is dependent on the nature of the product sold. Product arrangements comprising multiple deliverables including software and hardware are generally categorized into one of the following:

Services and Maintenance Revenue. Services and maintenance revenue consists of professional services, training, and maintenance. Revenue from such services is recognized as the services are provided.

Revenue related to technical support and software updates on a when-and-if available basis, which we refer to as maintenance revenue, is also included in services and maintenance revenue. We recognize all maintenance revenue ratably over the applicable maintenance period. We determine the amount of maintenance revenue to be deferred through reference to substantive maintenance renewal provisions contained in the arrangement. We consider substantive maintenance provisions to be provisions where the stated maintenance renewal as a percentage of the product fee is comparable to the normal pricing for maintenance only renewals.

Revenue Recognition Criteria. We recognize revenue when persuasive evidence of an arrangement exists, the element has been delivered, the fee is fixed or determinable and collection of the resulting receivable is probable. A discussion about these revenue recognition criteria and their applicability to our transactions follows:

We periodically evaluate all pending or threatened contingencies and commitments, if any, that are reasonably likely to have a material adverse effect on our operations or financial position. We assess the probability of an adverse outcome and determine if it is remote, reasonably possible or probable as defined in accordance with the provisions of SFAS No. 5, “Accounting for Contingencies.” If information available prior to the issuance of our financial statements indicates that it is probable that an asset had been impaired or a liability had been incurred at the date of our financial statements, and the amount of the loss, or the range of probable loss can be reasonably estimated, then such loss is accrued and charged to operations. If no accrual is made for a loss

contingency because one or both of the conditions pursuant to SFAS No. 5 are not met, but the probability of an adverse outcome is at least reasonably possible, we will disclose the nature of the contingency and provide an estimate of the possible loss or range of loss, or state that such an estimate cannot be made.

We maintain an allowance for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. The allowance is established through a provision for bad debt expense. We determine the adequacy of this allowance by evaluating individual customer accounts receivable, through consideration of the customer’s financial condition, credit history and current economic conditions. If the financial condition of our customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

In preparing our consolidated financial statements, we estimate our income tax liability in each of the jurisdictions in which we operate by estimating our actual current tax exposure and assessing temporary differences resulting from differing treatment of items for tax and financial statement purposes. As a result of the termination of our S Corporation status, we will record deferred tax assets, which we expect to be fully reserved. Management judgment will be required in assessing the realizability of this and future deferred tax assets. In performing these assessments, we consider whether it is more likely than not that some portion or all of the deferred tax assets will not be realized. The ultimate realization of deferred tax assets is dependent upon the generation of future taxable income during the periods in which those temporary differences become deductible. We consider the scheduled reversal of deferred tax liabilities, projected future taxable income, and tax planning strategies in making this assessment. In the event that actual results differ from our estimates or we adjust our estimates in future periods, we may need to make or adjust valuation allowances with respect to our deferred tax assets. Our income tax provision is based on calculations and assumptions that may be subject to examination by the Internal Revenue Service and other tax authorities. Should the actual results differ from our estimates, we would have to adjust the income tax provision in the period in which the facts that give rise to the revision become known. Tax law and rate changes are reflected in the income tax provision in the period in which such changes are enacted.

The following table sets forth selected statements of operations data for each of the periods indicated expressed as a percentage of total revenues:

Revenues. Revenues were $24.6 million for the six months ended June 30, 2006 compared to $16.8 million for the six months ended June 30, 2005, an increase of $7.8 million or 46.0%.

Product revenue was $13.2 million for the six months ended June 30, 2006 compared to $9.2 million for the six months ended June 30, 2005, an increase of $4.0 million or 43.7%. The increase in product revenue was a result of increased selling and marketing efforts, and a significant increase in head count of commissioned sales personnel. In addition, in late 2005 we introduced our eDiscovery Suite, which has substantially increased our average transaction size, although the number of eDiscovery Suite transactions has been limited. The first two quarters of each fiscal year is typically our period of lowest product sales due to the seasonal budgetary cycles of our customers.

Services and maintenance revenues were $11.4 million for the six months ended June 30, 2006 compared to $7.7 million for the six months ended June 30, 2005, an increase of $3.7 million or 48.8%. Services revenue grew by $1.8 million as a result of increased consulting engagements, training offerings and software implementations as well as increased utilization of salaried personnel and higher utilization rates in our Professional Services Division. In addition, maintenance revenue grew by $1.2 million as a result of increased new product sales and increases in maintenance renewal rates.

Cost of Revenues. Cost of revenues was $7.0 million for the six months ended June 30, 2006 compared to $5.1 million for the six months ended June 30, 2005, an increase of $1.9 million or 36.0%. Gross profit as a percentage of revenues was 71.6%, and 69.5% for the six months ended June 30, 2006 and 2005, respectively.

Cost of product revenue was $1.1 million for the six months ended June 30, 2006 compared to $1.0 million for the six months ended June 30, 2005, an increase of $0.1 million or 12.7%. Product gross margin was 91.5%

and 89.1%, respectively, for the six months ended June 30, 2006 and 2005. Product gross margin increased as a result of increased sales of our EnCase^® Enterprise product, which is a higher margin product than our EnCase^® Forensic product.

Cost of services and maintenance revenue was $5.9 million for the six months ended June 30, 2006 compared to $4.1 million for the six months ended June 30, 2005, an increase of $1.8 million or 41.6%. Cost of services and maintenance revenue grew primarily as a result of increased head count and facilities to provide increased consulting engagements, training offerings, software implementations and technical support. Services and maintenance gross margin was 48.7% for the six months ended June 30, 2006 compared to 46.1% for the six months ended June 30, 2005. The increase in services and maintenance gross margin was primarily due to increased demand and utilization offset by the hiring of new professional services personnel in the first quarter of 2006 to meet the increased demand.

Selling & Marketing. Selling and marketing expenses increased to $12.4 million for the six months ended June 30, 2006 compared to $7.1 million for the six months ended June 30, 2005, an increase of $5.3 million or 75.0%. The increase was primarily attributable to an increase in selling and marketing compensation expense for marketing personnel and commissioned sales representatives of $2.4 million, combined with an increase in travel expenses of $0.7 million and costs of $1.0 million associated with our Computer and Enterprise Investigations Conference (“CEIC^®”), and other tradeshows. Selling and marketing head count increased from 76 to 116 at the respective period ends. Selling and marketing expenses as a percentage of revenue increased to 50.4% for the six months ended June 30, 2006 from 42.1% for the six months ended June 30, 2005, primarily due to the hiring of new selling and marketing personnel who typically require several quarters to generate corresponding increases in revenue.

Research & Development. Research and development expenses increased to $3.3 million for the six months ended June 30, 2006 compared to $1.8 million for the six months ended June 30, 2005, an increase of $1.5 million or 84.0%. The increase was primarily due to an increase in research and development personnel from 22 to 46 at the respective period ends to develop new product offerings, continue developing existing products and improve quality assurance. Research and development expenses as a percentage of revenue for the six months ended June 30, 2006 increased to 13.6% compared to 10.8% for the six months ended June 30, 2005.

General & Administrative. General and administrative expenses increased to $3.6 million for the six months ended June 30, 2006 compared to $2.4 million for the six months ended June 30, 2005, an increase of $1.2 million or 49.3%. The increase was primarily attributable to an increase in compensation and temporary help expense of $0.7 million, as well as an increase in outside professional fees and depreciation expense as well as an increase in spending on information technology security. General and administrative expenses as a percentage of revenue decreased to 14.6% for the six months ended June 30, 2006 compared to 14.3% for the six months ended June 30, 2005. We expect our general and administrative expenses to increase in absolute dollars as we employ additional personnel and incur additional costs related to the growth of our business and our operation as a public company. Also, we expect to increase spending on information technology security to continue to enhance the integrity of our corporate network.

Revenues. Revenues were $39.5 million for the twelve months ended December 31, 2005 compared to $27.6 million for the twelve months ended December 31, 2004, an increase of $11.9 million or 43.1%.

Product revenue was $23.1 million for the twelve months ended December 31, 2005 compared to $15.8 million for the twelve months ended December 31, 2004, an increase of $7.3 million or 46.3%. The increase in product revenue was a result of continued growth of our EnCase^® Enterprise product, including introduction of our eDiscovery Suite in the fourth quarter of 2005 and increased selling and marketing efforts, which included significant increased head count of commissioned sales personnel. In addition, during the year ended December 31, 2004, we recognized revenues related to our EnCase^® Forensic product ratably over the

maintenance period. Starting in early 2005, we recognized product revenue related to the sale of EnCase^® Forensic to commercial customers upon delivery. This resulted in additional product revenue of $1.2 million being recognized in the year ended December 31, 2005, that would otherwise have been recognized in a subsequent period.

Services and maintenance revenue was $16.4 million for the twelve months ended December 31, 2005 compared to $11.8 million for the twelve months ended December 31, 2004, an increase of $4.6 million or 38.8%. Services revenue grew as a result of increases to the number, size and complexity of consulting engagements and software implementations and an increase to the number of training offerings. In addition, maintenance revenue grew as a result of increased product sales and increases in maintenance renewal rates.

Cost of Revenues. Cost of revenues was $11.7 million for the twelve months ended December 31, 2005 compared to $9.9 million for the twelve months ended December 31, 2004, an increase of $1.8 million or 18.2%. Gross profit as a percentage of revenues was 70.3% and 64.1% for the twelve months ended December 31, 2005 and 2004, respectively.

Cost of product revenue was $2.2 million for the twelve months ended December 31, 2005 compared to $1.7 million for the twelve months ended December 31, 2004, an increase of $0.5 million or 28.5%. Product gross margin was 90.4% and 89.1%, respectively, for the twelve months ended December 31, 2005 and 2004. Product gross margin increased as a result of spreading only slightly increased distribution costs over a greater revenue base, as well as increased sales of our EnCase^® Enterprise product, which is a higher margin product than our EnCase^® Forensic product.

Cost of services and maintenance revenue was $9.5 million for the twelve months ended December 31, 2005 compared to $8.2 million for the twelve months ended December 31, 2004, an increase of $1.3 million or 16.0%. Cost of services and maintenance revenue grew primarily as a result of increased head count and facilities to provide increased consulting engagements, training offerings, software implementations and technical support. Services and maintenance gross margin was 41.9% for the twelve months ended December 31, 2005 compared to 30.5% for the twelve months ended December 31, 2004. The increase in services and maintenance gross margin was primarily due to increased utilization of salaried personnel and higher utilization rates in our Professional Services Division. In addition, our Professional Services Division reached profitability in 2005, following its launch in 2003.

Selling & Marketing. Selling and marketing expenses increased to $16.2 million for the twelve months ended December 31, 2005 compared to $10.7 million for the twelve months ended December 31, 2004, an increase of $5.5 million or 51.4%. The increase was primarily attributable to an increase in selling and marketing compensation expense of $3.6 million, combined with an increase in conference, promotion, collateral and tradeshow expenses of $0.4 million and an increase in travel expenses of $0.5 million. Selling and marketing head count increased from 54 to 90 at the respective period ends. Higher selling and marketing commission expense was driven by accelerated sales of our EnCase^® Enterprise product, which carries a higher commission than our EnCase^® Forensic product. Selling and marketing expenses as a percentage of revenue increased to 41.0% for the twelve months ended December 31, 2005 from 38.7% for the twelve months ended December 31, 2004, due to the hiring of new selling and marketing personnel who typically require several quarters to generate corresponding increases in revenue and the growth of expenses from our hosted Computer and Enterprise Investigations Conference tradeshow.

Research & Development. Research and development expenses increased to $4.9 million for the twelve months ended December 31, 2005 compared to $3.7 million for the twelve months ended December 31, 2004, an increase of $1.2 million or 33.6%. The increase was primarily due to an increase in research and development personnel from 22 to 32 at the respective period ends to meet additional product development demands and quality assurance requirements. Research and development expenses as a percentage of revenue decreased to 12.4% for the twelve months ended December 31, 2005 compared to 13.3% for the twelve months ended December 31, 2004 as result of revenues outpacing our research and development hiring.

General & Administrative. General and administrative expenses increased to $5.2 million for the twelve months ended December 31, 2005 compared to $4.1 million for the twelve months ended December 31, 2004, an increase of $1.1 million or 25.3%. The increase was primarily attributable to an increase in outside professional fees of $0.6 million, as well to increased employee compensation and temporary help of $0.2 million and depreciation expense of $0.2 million. In addition, in the year ended December 31, 2005 we recorded a $0.5 million legal contingency accrual as a result of the security breach of our electronic records in December 2005 and the resulting FTC inquiry. General and administrative expenses as a percentage of revenue decreased to 13.1% for the twelve months ended December 31, 2005 compared to 15.0% for the twelve months ended December 31, 2004 as result of revenues outpacing our general and administrative hiring.

Revenues. Revenues were $27.6 million for the twelve months ended December 31, 2004 compared to $17.7 million for the twelve months ended December 31, 2003, an increase of $9.9 million or 55.9%.

Product revenue was $15.8 million for the twelve months ended December 31, 2004 compared to $9.8 million for the twelve months ended December 31, 2003, an increase of $6.0 million or 62.1%. The increase in product revenue was a result of increased selling and marketing efforts, which included significant increased head count of commissioned sales personnel. The launch of EnCase^® Enterprise in late 2002 drove product revenue throughout 2003 and 2004 as the product line became established in the marketplace.

Services and maintenance revenue was $11.8 million for the twelve months ended December 31, 2004 compared to $7.9 million for the twelve months ended December 31, 2003, an increase of $3.9 million or 48.3%. Services revenue grew as a result of increased consulting engagements, services utilization rates, training offerings and software implementations. In addition, maintenance revenue grew as a result of increased product sales.

Cost of Revenues. Cost of revenues were $9.9 million for the twelve months ended December 31, 2004 compared to $6.7 million for the twelve months ended December 31, 2003, an increase of $3.2 million or 47.8%. Gross profit as a percentage of revenues was 64.1%, and 62.1% for the twelve months ended December 31, 2004 and 2003, respectively.

Cost of product revenue remained consistent in absolute dollars at approximately $1.8 million for the twelve months ended December 31, 2004 and 2003, respectively. Product gross margins were 89.1% and 81.7%, respectively, for the twelve months ended December 31, 2004 and 2003. Product gross margin increased as a result of increased sales of our EnCase^® Enterprise product, which has a higher profit margin than our EnCase^® Forensic product.

Cost of services and maintenance revenue was $8.2 million for the twelve months ended December 31, 2004 compared to $4.9 million for the twelve months ended December 31, 2003, an increase of $3.3 million or 66.3%. Cost of services and maintenance revenue grew primarily as a result of increased head count and facilities to provide increased consulting engagements, training offerings, software implementations and technical support. Services and maintenance gross margin was 30.5% for the twelve months ended December 31, 2004 compared to 38.0% for the twelve months ended December 31, 2003. The decrease in services and maintenance gross margin was primarily due to the investment in the newly launched Professional Services Division and additional technical support services, partially offset by growth in maintenance revenue.

Selling & Marketing. Selling and marketing expenses increased to $10.7 million for the twelve months ended December 31, 2004 compared to $6.3 million for the twelve months ended December 31, 2003, an increase of $4.4 million or 70.6%. The increase was primarily attributable to an increase in selling and marketing compensation expense of $3.2 million, combined with an increase in travel expenses of $0.4 million. Selling and marketing head count increased from 34 to 54 at the respective period ends. Selling and marketing expenses as a percentage of revenue increased to 38.7% for the twelve months ended December 31, 2004 from 35.4% for the

twelve months ended December 31, 2003, due to the hiring of new sales personnel to directly target EnCase^® Enterprise customers and the growth of expenses from our hosted Computer and Enterprise Investigations Conference tradeshow. The new commissioned sales personnel required several quarters to generate increases in revenue.

Research & Development. Research and development expenses increased to $3.7 million for the twelve months ended December 31, 2004 compared to $2.1 million for the twelve months ended December 31, 2003, an increase of $1.6 million or 76.4%. The increase was primarily due to an increase in research and development personnel from 13 to 22 at the respective period ends. Research and development expenses as a percentage of revenue increased to 13.3% for the twelve months ended December 31, 2004 compared to 11.8% for the twelve months ended December 31, 2003 as a result of an emphasis on research and development hiring.

General & Administrative. General and administrative expenses decreased to $4.1 million for the twelve months ended December 31, 2004 compared to $4.3 million for the twelve months ended December 31, 2003, a decrease of $0.2 million or 3.0%. General and administrative expenses as a percentage of revenue decreased to 15.0% for the twelve months ended December 31, 2004 compared to 24.1% for the twelve months ended December 31, 2003 as a result of cost control efforts we implemented in 2004 to reduce our general and administrative expense to a level more consistent with our business plan.

The following table presents selected items from our unaudited quarterly consolidated results of operations for our most recent ten quarters including the quarter ended June 30, 2006. You should read the following table in conjunction with the consolidated financial statements and the related notes appearing elsewhere in this prospectus. We have prepared the data on the same basis as our audited annual consolidated financial statements. This table includes all adjustments, consisting solely of normal recurring adjustments, that we consider necessary for a fair presentation of our financial position and operating results for the quarters presented. Operating results for any quarter are not indicative of results for any future quarters or for a full year.

Revenues. Revenues increased year over year in each of the quarters presented. We experience seasonality in our revenue, with the third and fourth quarters typically having the highest revenue for the year and the first quarter having the lowest revenue. We believe that this seasonality results primarily from our customers’ budgeting cycles. The federal government budget year ends in the third calendar quarter of the year and a majority of corporate budget years end in the fourth calendar quarter of the year. In addition, our customers also tend to make software purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of the period in question until software purchase decisions have been made and license agreements have been entered into. We expect that this seasonality within a particular year and unpredictability within a particular quarterly period will continue for the foreseeable future.

Cost of Revenues. Cost of revenues in absolute dollars and gross profit as a percentage of revenues increased quarter over previous comparable quarter in each of the quarters presented.

Cost of product revenue has generally declined as a percentage of revenues for the quarters presented. This is due largely to a shift in product mix from EnCase^® Forensic toward EnCase^® Enterprise, which has a higher gross margin.

Cost of services and maintenance revenue has generally declined as a percentage of revenues for the quarters presented. This is due to increased utilization of our Professional Services Division, as well as a shift in services and maintenance mix towards maintenance revenue as product sales increased, which has a higher gross margin than professional services and training.

Selling & Marketing. Selling and marketing expenses generally increased sequentially in absolute dollars in each of the quarters presented as a result of an increase in selling and marketing compensation expense for commissioned selling and marketing personnel, combined with an increase in conference, promotion, collateral and tradeshow expenses. We have continued to invest in our selling and marketing efforts. The increase in the last two quarters presented was a result of increasing sales personnel to sell our EnCase^® Enterprise and our eDiscovery Suite. In the second quarter of 2006 we incurred approximately $1.0 million in expenses related to our user conference, Computer and Enterprise Investigations Conference.

Research & Development. Research and development expenses have remained largely consistent for the quarters presented, except for the last four quarters presented. The increases in these quarters were the result of discretionary bonuses accrued for our research and development personnel in the third and fourth quarters of 2005 as a result of meeting our internal goals. For each of the four quarters we experienced an increase in research and development compensation expense related to an increase in research and development personnel.

General & Administrative. General and administrative expenses increased in the fourth quarter of 2005 and the first and second quarters of 2006 as we began to prepare to become a public company. In addition, in the fourth quarter of 2005 we accrued $0.5 million for the security breach of our electronic records in December 2005 and the resulting FTC inquiry. This increase was partially offset by fluctuations in the timing of employee-related spending and use of outsourced services. We anticipate real estate expenses to steadily increase for the next 12-24 months as we continue to invest in our corporate infrastructure.

Since inception, we have largely financed our operations by generating positive cash flow from operations. As of June 30, 2006, we had $4.0 million in cash and cash equivalents.

We derive cash from operations primarily from cash collected upon the sale of our products and related services. Net cash used in operating activities was $0.4 million in the six months ended June 30, 2006 compared with net cash provided from operations of $2.8 million in the six months ended June 30, 2005. The decrease in cash provided resulted from increased payroll and related costs in the six months ended June 30, 2006 from the comparable period in the prior year associated with additional sales and development personnel to market our

existing products and develop new solutions as well as increased cash collections related to the release of a new version of EnCase^® Forensic software in March 2005 for which there was no comparable product release in the six months ended June 30, 2006. Net cash provided by operating activities was $7.5 million and $1.2 million, respectively, in the years ended December 31, 2005 and 2004. The increase in cash generated by operations between the periods principally reflects an increase in cash collected from customers due to new offerings including our Premium License Support Program offering in late 2004 as well as an increase in EnCase^® Enterprise license sales. Net cash provided by operating activities was $1.2 million and $0.7 million, respectively, in the years ended December 31, 2004 and 2003.

Net cash used in investing activities was $1.6 million, $1.0 million, $0.9 million and $1.0 million, respectively, in the six months ended June 30, 2006 and the years ended December 31, 2005, 2004 and 2003. Investing activities for all periods consisted of capital expenditures, which consisted primarily of office and computer equipment for all of our departments.

Net cash provided by (used in) financing activities was ($1.6) million, ($1.3) million, ($0.7) million and $2.7 million, respectively, in the six months ended June 30, 2006 and years ended December 31, 2005, 2004 and 2003. In each of the periods, cash used in financing activities largely consisted of borrowing and payments against our line of credits, shareholder loans and capital leases. In the six months ended June 30, 2006, we paid a $1.7 million distribution to our shareholders to cover S Corporation taxable earnings, which was partially offset by stock option exercise proceeds of $0.8 million. For the year ended December 31, 2003 we issued common stock and a warrant to a related party investor for $2.3 million.

During the years ended December 31, 2003 and 2004, Shawn McCreight, our Founder, Chairman and Chief Technology Officer, made loans to us on an unsecured basis, which obligations bore interest at a rate equal to 5% per annum on the unpaid principal balance and were due in full on December 31, 2004. We borrowed the funds from Mr. McCreight in lieu of drawing down funds on our then-existing working capital line of credit with our former bank. The highest loan balance that was owed to Mr. McCreight during this period was approximately $200,000. All amounts loaned by Mr. McCreight to us and related interest thereon were repaid in full in January 2004 and no further amounts are owed to him.

Other than the final distribution of our paid-in capital and undistributed accumulated S Corporation net income, we currently have no material cash commitments, except our normal recurring trade payables, expense accruals and leases, all of which are currently expected to be funded through existing working capital and future cash flows from operations. In addition, we currently have a $3.0 million revolving line of credit with Bank of the West that expires in October 2007.

At December 31, 2005, our outstanding contractual cash commitments were limited to our non-cancelable lease obligations, primarily relating to real estate, as follows:

We believe that our existing cash and cash equivalents balances, availability under our revolving line of credit and cash provided by operating activities will be sufficient to meet our working capital, capital expenditure and other cash requirement needs over at least the next 12 months, other than the final distribution of our paid-in capital and undistributed accumulated S Corporation net income, which will be funded in part by the proceeds of this offering. Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our selling and marketing activities, the timing and extent of research and development

spending to support product development and enhancement efforts, costs associated with expansion into new territories or markets, the timing of the introduction of new products and services and the enhancement of existing products and the continuing market acceptance of our products and services. To the extent that funds generated by this initial public offering, together with existing cash, the availability under our line of credit and cash from operations, are insufficient to fund our future activities and planned growth, we may need to raise additional funds through public or private equity or debt financings. Although we are currently not a party to any agreement or letter of intent with respect to potential investments in, or acquisitions of, complementary businesses, products or technologies, we may enter into these types of arrangements in the future, which could also require us to seek additional debt or equity financing. Additional funds may not be available on terms favorable to us or at all. Furthermore, although we cannot accurately anticipate the effect of inflation or foreign exchange markets on our operations, we do not believe these external economic forces have had, or are likely in the foreseeable future to have, a material impact on our results of operations.

At December 31, 2005, we did not have any relationships with unconsolidated entities or financial partnerships, such as entities often referred to as structured finance, special-purpose, or variable interest entities, which would have been established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes. In addition, we did not engage in trading activities involving non-exchange traded contracts. As a result, we are not exposed to any financing, liquidity, market or credit risks that could arise if we had engaged in such relationships. We do not have material relationships and transactions with persons or entities that derive benefits from their non-independent relationship with us or our related parties except as disclosed in this prospectus.

In November 2004, the FASB issued SFAS No. 151, “Inventory Costs—an Amendment of ARB No. 43, Chapter 4” (“SFAS 151”). SFAS 151 requires that accounting for items such as idle facility expense, freight, handling costs, and wasted materials be recognized as current period charges regardless of whether they meet the criterion of “so abnormal.” In addition, this Statement requires that allocation of fixed production overheads to the costs of conversion be based on the normal capacity of the production facilities. This Statement is effective for inventory costs incurred during fiscal years beginning after June 15, 2005. The provision of this Statement shall be applied prospectively. We believe that the adoption of SFAS 151 will not have a material effect on our Consolidated Financial Statements.

In May 2005, the FASB issued SFAS No. 154, “Accounting Changes and Error Corrections,” (“SFAS 154”), which is a replacement of APB Opinion No. 20, “Accounting Changes,” and FASB Statement No. 3, “Reporting Accounting Changes in Interim Financial Statements.” SFAS 154 does not change the transition provisions of any existing accounting pronouncements, including those that are in a transition phase as of the effective date of SFAS 154. SFAS 154 applies to all voluntary changes in accounting principle, and changes the requirements for accounting for and reporting of a change in accounting principle. SFAS 154 requires retrospective application to prior periods’ financial statements of a voluntary change in accounting principle unless it is impractical. SFAS 154 is effective for accounting changes and corrections of errors made in fiscal years beginning after December 15, 2005. Our results of operations and financial condition will only be impacted by SFAS 154 if we implement changes in accounting principles that are addressed by the standard or corrects accounting errors in future periods.

In February 2006, the FASB issued SFAS No. 155, “Accounting for Certain Hybrid Financial Instruments—an amendment of FASB Statements No. 133 and 140” (“SFAS 155”), to simplify and make more consistent the accounting for certain financial instruments. Specifically, SFAS 155 amends SFAS No. 133, “Accounting for Derivative Instruments and Hedging Activities,” to permit fair value remeasurement for any hybrid financial instrument with an embedded derivative that otherwise would require bifurcation, provided that the whole instrument is accounted for on a fair value basis. SFAS 155 amends SFAS No. 140, “Accounting for the Impairment or Disposal of Long-Lived Assets,” to allow a qualifying special-purpose entity to hold a derivative

financial instrument that pertains to a beneficial interest other than another derivative financial instrument. SFAS 155 applies to all financial instruments acquired or issued after the beginning of an entity’s first fiscal year that begins after September 15, 2006, with earlier application allowed. We do not expect the adoption of SFAS 155 to have a significant impact on our consolidated results of operations or our financial position.

In June 2006, the FASB issued FASB Interpretation No. 48, “Accounting for Uncertainty in Income Taxes—an interpretation of FASB Statement No. 109” (“FIN 48”). The interpretation clarifies the accounting for uncertainty in income taxes recognized in a company’s financial statements in accordance with SFAS No. 109, “Accounting for Income Taxes.” Specifically, the pronouncement prescribes a recognition threshold and a measurement attribute for the financial statement recognition and measurement of a tax position taken or expected to be taken in a tax return. The interpretation also provides guidance on the related derecognition, classification, interest and penalties, accounting for interim periods, disclosure and transition of uncertain tax positions. This interpretation is effective for fiscal years beginning after December 15, 2006. We are assessing FIN 48 and have not determined the impact that the adoption of FIN 48 will have on our consolidated financial statements.

Due to the nature of our short-term investments, we have concluded that there is no material market risk exposure.

Foreign Currency Exchange Risk. Although we currently bill for our products and services mostly in U.S. dollars, our financial results could be affected by factors such as changes in foreign currency rates or weak economic conditions in foreign markets. A strengthening of the dollar could make our products and services less competitive in foreign markets and therefore could reduce our revenues. We are billed by and pay substantially all of our vendors in U.S. dollars. In the future, an increased portion of our revenues and costs may be denominated in foreign currencies. To date, exchange rate fluctuations have had little impact on our operating results.

Interest Rate Sensitivity. We had unrestricted cash and cash equivalents totaling $4.0 million at June 30, 2006. These amounts were invested primarily in money market funds. The unrestricted cash and cash equivalents are held for working capital purposes. We do not enter into investments for trading or speculative purposes. Due to the short-term nature of these investments, we believe that we do not have any material exposure to changes in the fair value of our investment portfolio as a result of changes in interest rates. Declines in interest rates, however, will reduce future investment income.

We develop and provide the leading software solutions for digital investigations. EnCase^® Enterprise, our flagship product, enables corporations and government agencies to search, collect, preserve and analyze, from a single location, data across the servers, desktops and laptops that comprise their entire network. Our EnCase^® Forensic software, which we believe is the industry standard tool in the field of digital forensic software, is used primarily by law enforcement and government agencies for searching, collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court proceedings. We also offer a comprehensive array of forensic investigation and training services to help our customers manage their internal digital investigations and learn how to effectively and efficiently use our software. Our EnCase^® Enterprise customer base currently includes more than 90 companies in the Fortune 500, and we have deployed approximately 24,000 units of our EnCase^® Forensic software to more than 1,000 government and law enforcement agencies and other customers worldwide.

The widespread reliance on digital business processes and the explosive growth in volume of electronic data has resulted in exposure to electronic data-related risks and created the need to properly conduct digital investigations.

The global adoption of local area networks, wide area networks, e-mail and the Internet has increased communications within and between organizations and has created the ability to generate, store, share and distribute massive amounts of electronic information instantaneously without regard to physical location. While the adoption and reliance on these technologies has significantly increased productivity and lowered the cost of doing business for Global 2000 companies, government agencies and other organizations, it has also exposed organizations to many increasing areas of risk associated with the continued proliferation of electronic data. Organizations now are increasingly faced with the need to recover and analyze vast amounts of electronic data quickly and efficiently through processes we refer to as digital investigations. Digital investigations are conducted to address various electronic data-related needs, including:

Traditional investigations into electronic data-related threats are inadequate.

Traditional digital investigations involve internal investigators or third-party consultants manually searching through a multitude of electronic data in an attempt to discover traces or “fingerprints” of an electronic data-related incident. Such investigators or third-party consultants typically use software applications, utilities or processes, such as taking the affected servers, desktops and laptops off-line, so that they can remove, image or copy the hard drives, manually extract the data in question on each affected computer and save the affected files

to another hard drive for processing and analysis by consultants or other third-party experts. These traditional digital investigations suffer from several distinct problems:

Are costly and time-consuming. Most electronic data-related incidents that occur today involve more than one machine, and often involve hundreds of thousands of servers, desktops and laptops operating across an enterprise including remote offices or workgroups, making the task of conducting manual investigations time-consuming, costly, and often beyond the resources of internal IT personnel.

Require significant expertise to conduct across a complex enterprise network environment. An organization’s enterprise network generally consists of multiple operating system platforms and software applications operating simultaneously across a network of servers, desktops and laptops with layers of data that need to be identified, recovered, organized, analyzed, preserved and presented during the investigative process. In the context of a manual digital investigation, understanding the intricacies of each of the multiple operating system platforms and software applications requires extensive training and a high level of human expertise.

May not adequately combat attempts to conceal data. An effective digital investigation must uncover and analyze all of the data relevant to the particular issue. This is extremely difficult to achieve in the digital world because perpetrators of malicious acts are typically motivated to hide incriminating evidence. Also, certain forms of IT security exploits, such as rootkits or keystroke loggers, embed themselves deep within the operating system and are undetectable by typical anti-virus software packages. Capturing data to facilitate the investigation is complicated, and traditional digital investigative techniques generally fail to capture all relevant data.

Often result in unwanted exposure of sensitive materials and disrupt business. Traditional digital investigative methods often result in physically removing the machines in question from the users and manually searching the hard drives for relevant data, thereby informing the subject employees and co-workers of the ongoing investigative process. In addition, traditional digital investigations can result in significant business disruption by removing affected machines from their users for extended periods of time.

Are difficult to conduct in a forensically sound manner. Digital investigations must be conducted in a forensically sound manner in order to preserve evidence for effective use in a court proceeding. In order to produce forensically sound evidence that can withstand legal challenges, including chain of custody, storage, cross-contamination and tampering allegations, any digital investigation must be conducted by expert personnel at all stages of the investigative process. Such personnel must be able to competently demonstrate that the chain of custody with respect to the evidence has not been broken or compromised and that the digital evidence has been properly stored in its originally discovered state without changes or alterations. Use of software applications, utilities or processes not designed to meet this legal threshold may damage, alter or overwrite evidence, such as critical dates and times, which may ultimately result in the evidence being refused by the court, or being substantially reduced in evidentiary value.

Establishing a comprehensive digital investigative software platform can help organizations address the inadequacies of traditional digital investigations and cost-effectively mitigate the risk of electronic data-related threats.

In order to effectively address the problems associated with traditional digital investigations, organizations require a comprehensive digital investigative software platform that enables them to cost-effectively conduct digital investigations at any time, quickly respond to eDiscovery requests and take decisive action in response to internal and external IT security and data breaches. Failure to effectively implement such a platform can expose an organization to significant risk and, in the case of the regulatory and legal environment, may subject the organization to criminal or civil financial or legal penalties, fines or adverse judgments. For example, UBS AG recently suffered an adverse judgment of approximately $29.2 million and Phillip Morris USA was recently fined approximately $2.75 million for non-compliance with eDiscovery requests.

The market for digital investigation and cyber forensic solutions is expected to grow from $600 million in 2005 to $1.4 billion in 2009, representing a compounded annual growth rate of 24%, according to International

Data Corporation. The market for eDiscovery solutions is expected to grow from $832 million in 2004 to $3.1 billion in 2008, representing a compounded annual growth rate of approximately 40%, according to Socha-Gelbmann. According to the 2005 Litigation Trends Survey by Fulbright & Jaworski LLP, a law firm, the average U.S. corporation with over $1 billion in revenues is involved in more than 140 domestic lawsuits at any given time. This survey polled 354 corporate general counsel in the United States and United Kingdom.

We believe that pending amendments to the Federal Rules of Civil Procedure will motivate companies regularly involved in litigation in the federal courts to implement digital investigative software. These amendments, which will apply to all federal civil litigation initiated after December 1, 2006, mandate that litigants must meet after commencing litigation to discuss production of electronic evidence, specify that the general obligation of litigants to identify and preserve relevant evidence explicitly applies to electronic data in their possession, and empower litigants conducting discovery to specify the electronic format in which the other party should produce the electronic data. This is in contrast to the current litigation environment, in which there is no specific obligation to meet and discuss production of electronic evidence and both the obligation to preserve and identify electronic evidence and the format in which electronic data is produced during discovery are themselves the subject of frequent disputes between the parties.

We develop and provide the leading software solutions to conduct digital investigations. The key benefits and advantages of our products and services include:

Our EnCase^® Enterprise software is designed to conduct enterprise-class digital investigations and operate across the largest and most complex enterprise network environments.

Our EnCase^® Enterprise software is a network-enabled solution that allows corporations and government agencies to search, collect, preserve and analyze, from a single location, data across all of the servers, desktops and laptops that comprise their network and is designed to efficiently conduct enterprise-class digital investigations. EnCase^® Enterprise enables our customers to rapidly search across networks of up to hundreds of thousands of servers, desktops or laptops. Our software also interoperates with a wide variety of computing environments that are typically found within the networks of large enterprise companies, including across 16 unique operating systems and 21 unique file systems. Customers can add our eDiscovery Suite to EnCase^® Enterprise to enable them to automate the traditionally manual eDiscovery process, or our Automated Incident Response Suite to EnCase^® Enterprise to automate the response to security breaches. Each of these add-on suites is modular, offering customers the option to deploy the entire EnCase^® Enterprise solution all at once, or incrementally as their future needs arise. In addition, our customers may continue to enhance the capabilities of our EnCase^® Enterprise software by utilizing our EnScript^® programming language to write or incorporate customized applications specific to their network environments or investigative needs. These broad-ranging capabilities of our EnCase^® Enterprise software give our customers the essential foundation on which to build a sophisticated, sound and secure platform for digital investigations.

Our EnCase^® products and services provide cost-effective and efficient digital investigation solutions.

Our EnCase^® products and services significantly reduce the disruption and expense entailed in a traditional digital investigation. The sophisticated technological capabilities of our EnCase^® products often permit our customers to reduce the use of multiple third-party computer forensics, managed security services and consulting companies, thereby reducing the costs and resources required to conduct a comprehensive digital investigation. In addition, our customers are able to address issues that historically have often been ignored or not timely addressed due to the extensive cost and time resources required to complete such traditional digital investigations.

Our software enables comprehensive digital investigations by discovering concealed data.

One fundamental capability underlying our EnCase^® Enterprise and EnCase^® Forensic software is the ability to discover hidden or concealed data, such as rootkits. We have designed our software to run “beneath”

the operating system, which enables our software to access the hard drive at the sector level, which is the smallest writeable area on a hard drive. Using our EnCase^® software, our customers are able to collect data from the sectors on the hard drive in a raw format and analyze the entire accessible hard drive, including files not generally accessible to the average user. The software collects and stores this electronic data without any modifications that normally result from the traditional approach of detection, recovery and analysis of such data.

Our products and services are designed to minimize any disruption to business and to preserve the confidentiality of any investigation.

Our EnCase^® software architecture enables customers to easily gain access and visibility into their entire IT infrastructure, which could easily comprise hundreds of thousands of servers, desktops or laptops, and permits trained data security personnel to conduct digital investigations from a single, centralized console, all without disrupting business operations or unnecessarily alerting employees. Our EnCase^® products and services thereby enable our customers not only to minimize the disruption to their businesses resulting from the shutdown or removal of servers, desktops and laptops, but also to preserve the sensitivity and confidentiality of any digital investigation.

EnCase^® software, which is the recognized standard for digital investigations in the courtroom, preserves forensically sound digital evidence for presentation by investigators.

We believe that EnCase^® software is the most widely recognized and trusted digital investigative solution across the Global 2000 and among federal, state, local and foreign government agencies. Since its introduction in 1998, EnCase^® software has been used in thousands of criminal and civil cases, including a number of the recent highest profile criminal cases, such as the Scott Peterson murder trial and the BTK killer case. There is established case law that affirmatively supports the admissibility of digital evidence collected via EnCase^® software, as it has been cited by name or discussed in over 35 judicial decisions or opinions from federal, state and foreign courts. From our first beta release in 1998 to our fifth generation product released in 2005, EnCase^® Forensic has been designed to enable increasingly powerful forensics capabilities for our customers while placing the utmost emphasis on processes and procedures that demonstrate the integrity of the investigative process in court. As a result, EnCase^® software has become a globally recognized standard for digital investigations and trusted electronic data collection.

Our consulting, implementation and training services enhance the capabilities of our product offerings.

We offer a comprehensive array of consulting, implementation and training services to help our customers implement our EnCase^® software and create customized applications using our EnScript^® programming language. We also provide eDiscovery and computer security incident response services, conduct digital investigations on behalf of our customers and perform systems and software maintenance and document retention audits. Many of our professional consultants are asked to testify in court as industry experts in the field of computer forensic investigations. Our training program offerings enable our customers to learn how to maximize the capabilities of our EnCase^® software, thereby permitting our customers to maintain digital investigation expertise within their organizations. In addition to the training courses, we also provide an EnCase^® Certified Examiner (“EnCE™”), program which certifies the competency of public and private sector employees in the best practices of digital forensic investigations and in the use of our EnCase^® software products in such digital investigations.

Our EnCase^® products are designed to meet the unique digital investigative needs of federal, state, local and foreign government agencies and law enforcement personnel.

Our EnCase^® Forensic software enables federal, state, local and foreign government agencies and law enforcement personnel to conduct, on a single machine, the full array of forensic functions, including data capture, analysis and the documentation and reporting of digital evidence, all while preserving the legal integrity of the investigation process. Many of these government agencies also use our EnCase^® Enterprise software to

address their specific internal digital investigative concerns, including classified message leaks and cyber warfare.

Expand the market for an enterprise investigative infrastructure solution.

Our EnCase^® Enterprise software, enhanced with our eDiscovery Suite and Automatic Incident Response Suite products, enables our customers to build what we refer to as an enterprise investigative infrastructure. An enterprise investigative infrastructure provides an organization with comprehensive policies, technical expertise, hardware, software and organizational structure that facilitates all types of digital investigations. We intend to continue raising awareness of the need for an enterprise investigative infrastructure solution through directing our marketing efforts at C-level decision makers, sponsoring seminars featuring keynote speakers that have significant influence in the industry, continuing to educate our customers through our sales efforts, professional services and training program offerings and working with our partners in the legal community to help them articulate the enterprise investigative infrastructure solution to their clients. We believe we have established a leadership position in this new industry as both a successful provider of digital investigative products and services and as a key thought leader helping to define the architecture and vision of digital investigations. We seek to extend our leadership position in this industry by continuing to innovate and launch new products and services to address the increasingly complex needs of the digital investigation community.

Continue to drive revenue growth by pursuing new customers, providing additional products and services to our base of existing customers and expanding internationally.

Our sales strategy is primarily focused on securing new customers in the United States in the corporate and government markets. We plan to continue providing additional modules and services to existing EnCase^® Enterprise customers to enhance their ability to realize the benefits of a total enterprise investigative infrastructure solution. Since a portion of our existing EnCase^® Enterprise customers only have the introductory level bundle of our EnCase^® Enterprise software product, our sales strategy for these customers focuses on follow-on sales of additional products, professional services and training. For the fiscal year ended December 31, 2005, we derived approximately 25% of our revenues from sales of products and services outside the United States. We believe that there is a large opportunity to market and sell our EnCase^® Enterprise solutions in the Europe, Middle East and Africa (“EMEA”) and Asia-Pacific regions, and therefore we are continuing to invest in sales and distribution infrastructure to address these under-penetrated markets. We recently opened a regional headquarters in EMEA, and have also launched direct and indirect sales efforts in Canada, Mexico, Brazil, Japan and Singapore. Our products are now available in 10 languages, including double-byte capability for Asian languages.

Continue to be a leading innovator in the investigative technology industry.

We plan to continue creating new software offerings that enable our customers to further leverage the power of our digital investigation software solutions. We maintain an advanced research group that focuses on developing next generation concepts in digital investigative forensics by responding to user feedback and other key influencers in the digital forensics and legal communities and monitoring industry and technology trends. In addition, our Professional Services Division is often engaged to build customized applications utilizing our EnScript^® programming language for specific customer needs. Since we retain the ownership of the actual code used in such customized applications, we have the ability to develop future products that are applicable to our broad customer base as a result of these professional engagements. When appropriate, we then turn these end products into separate add-on modules available for all customers or incorporate them into the general software

code base. We believe our in-house, proprietary approach to software development is a competitive advantage, and we plan to continue to maintain this approach in the future.

Continue to maintain our legal recognition as a barrier to entry into our industry.

We believe that EnCase^® software is the leading digital investigative solution across the Global 2000 and among federal, state, local and foreign government agencies. We continue to make great efforts to ensure that our products continue to be respected as the leading digital investigative solution. Our software products are designed to comply with United States federal and state rules of evidence and to withstand legal challenges in civil and criminal proceedings. Our products have been used in thousands of criminal and civil cases in federal, state and foreign courts, and EnCase^® software has been cited by name or discussed in over 35 judicial decisions or opinions, including at the appellate court level. This process of judicial recognition and validation is a lengthy, time-consuming process that requires years of litigation and appeals, and cannot be easily replicated. We have had members of our team testify in court proceedings or provide affidavits in connection with the development, credibility and proper use of our products. In addition, we place a strong emphasis on training our customers and users on the best practices of digital investigations and the use of our products in such investigations to maintain a reputation for reliability. We also publish the EnCase^® Legal Journal and white papers on certain key topics of interest to our user community to further this effort.

We believe that as we continue to train or certify more users on our software products, these users will help us to drive wider adoption of EnCase^® Enterprise and emphasize the importance of an enterprise investigative infrastructure solution. In the year ended December 31, 2005, we trained approximately 3,000 individuals through approximately 3,800 paid courses on various computer forensics and EnCase^® software topics, and we offered our training services in 19 countries and five languages. In turn, the increasing use of EnCase^® Enterprise by corporations and federal, state, local and foreign government agencies will continue to drive the need for more users to become trained on our software product offerings, particularly since our training course offerings and EnCE™ certification program often makes these individuals more sought after in the job marketplace. We believe our annual user conference, known as the Computer and Enterprise Investigations Conference, has become the leading gathering place for the computer forensics and digital investigations industry. Our 2006 Computer and Enterprise Investigations Conference had approximately 700 participants, and we will continue to hold this conference to allow our users to connect, share and learn about important topics and products in the computer forensics and digital investigations industry. We also provide all of our users with an online community where they can share ideas with each other and provide feedback to us on the products. Through this online community, hundreds of customized EnScript programs that automate specific processes when run on EnCase^® Enterprise or EnCase^® Forensic have been published by, and downloaded from, our large user community. In addition, certain third parties have written commercial applications that utilize the EnScript programming language to leverage the capabilities of EnCase^® software. We believe this community of developers and users helps to drive a network effect that contributes substantially to our competitive barriers to entry, and we will continue to actively drive this network effect in the future.

Our user community has grown to encompass IT and forensics investigators at a significant number of federal and state governments, local investigative bodies and corporations. We believe this loyal user base is one of our most valuable assets. We maintain a separate group within our sales organization that is responsible for calling on existing customers to ensure full customer satisfaction. We have implemented a program that includes a follow-up visit to certain new customers approximately three months after implementation to confirm customer satisfaction and respond to user questions and functionality issues. In order to promote better customer service, we have also expanded our customer support hours, which are now available 24 hours a day during the business week, while maintaining technical support services to our customers 24 hours per day, 7 days per week.

Our products and services give our customers the ability to conduct comprehensive, cost-effective and precise digital investigations. Our EnCase^® Enterprise software, enhanced with our eDiscovery Suite and our Automatic Incident Response Suite products, provide the foundation to build an enterprise investigative infrastructure. Furthermore, we believe our EnCase^® Forensic software is the industry standard for searching, collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court proceedings. We also offer a comprehensive array of forensic investigation and training services to help our customers manage their internal digital investigations and learn how to effectively and efficiently use our software.

EnCase^® Enterprise provides an investigative platform that enables an organization to search, collect, preserve and analyze data on the servers, desktops and laptops on its computer network. EnCase^® Enterprise enables organizations to conduct internal investigations, whether HR-related or focused on compliance or fraud, collect and preserve data in response to requests from regulators or for civil litigation matters and take decisive action in the face of security and data breaches, whether the origin of the worm, virus or other exploit is internal (e.g., “rogue employees”) or external (e.g., “hackers”).

EnCase^® Enterprise serves as the platform to an enterprise investigative infrastructure, upon which additional modules, such as our EnCase^® eDiscovery Suite and Automatic Incident Response Suite, can be added to enhance and automate the search, collection, preservation and analysis of data in order to accomplish specific tasks, such as electronic discovery or computer security incident response. EnCase^® Enterprise products consist of five separate components: the Examiner, the SAFE, the Servlet, the Enterprise Concurrent Connection and SnapShot.

Examiner. The Examiner provides the user with a graphical user interface through which the user can access, interact and enable the various capabilities of EnCase^® Enterprise. Key features of the Examiner include advanced filtering, multiple case management, the ability to search and analyze structured and unstructured data and multi-lingual support.

SAFE. The SAFE (Secure Authentication for EnCase^®) is primarily an authentication tool that ensures that the Examiner is properly credentialed before permitting the Examiner to access a server, desktop or laptop on the network. The SAFE allows the organization to control the Examiner’s access to information, which is critical to ensuring the proper segregation of duties and restricting access to sensitive information. The SAFE also controls communications between EnCase^® Enterprise components, encrypts data transfer between such components and controls user authentication. Every connection between any two computers is uniquely encrypted and controlled by the SAFE to prevent circumvention of the system or the theft of data in transit.

Servlet. The Servlet is a small, non-intrusive piece of software that is deployed on each server, desktop or laptop to which investigative access is sought. The Servlet is designed to be easily deployed over the network across thousands of servers, desktops and laptops within hours and not to interfere with any existing applications or processes. The Servlet enables the Examiner to access information on the target server, desktop or laptop, including the contents of both static and volatile memory.

Enterprise Concurrent Connection. The Enterprise Concurrent Connection is a single secure virtual connection established between the Examiner and the servers, desktops or laptops that are being searched or investigated. In essence, the Enterprise Concurrent Connection is a licensing tool limiting the number of computers that can be analyzed simultaneously; the greater the number of Enterprise Concurrent Connections that are licensed, the more quickly the organization can search large quantities of data residing on its servers, desktops and laptops.

Snapshot. Snapshot is an add-on module to EnCase^® Enterprise that captures data and information stored in the Random Access Memory (“RAM”) of servers, desktops and laptops on an organization’s network.

Information such as the listings of the logged-on users, open ports and open files currently in use on a system, applications and active processes currently running on the system and the live registry are located in RAM. Snapshot captures this information and provides the user with an easy-to-use report on what was occurring on a system at a given point in time. The Snapshot technology enables the user to scan thousands of computers to detect, collect, preserve and remediate any network intrusion on an enterprise-wide scale. It is also used to determine the scope of certain eDiscovery or human resources investigations.

The EnCase^® eDiscovery Suite automates the search, collection and preservation of data across multiple servers, desktops or laptops on an organization’s network. The user is able to utilize the EnCase^® eDiscovery Suite to search specifically targeted computers and collect only the potentially relevant information, thereby eliminating the collection, processing and review of meaningless or duplicate information. The EnCase^® eDiscovery Suite allows the user to search and collect data from servers, desktops or laptops throughout the enterprise, and searches can be conducted based on a variety of criteria, including, but not limited to, by file type, “keywords,” custodian, file digital fingerprint, or metadata such as creation, modified or last accessed times, or any combination of these criteria. The EnCase^® eDiscovery Suite is able to collect individual files, including the associated metadata, while preserving the data in its original state, including, uniquely, the associated metadata.

The EnCase^® eDiscovery Suite collects and preserves data based on the selected search criteria provided by the user. The search and collection of data can be performed around the clock on an automated basis, and can be scaled to the size of large enterprises. The software enables large-scale collections to be performed across the network without disrupting business or the network or taking servers off-line. The EnCase^® eDiscovery Suite tracks collection results in a database, so that at any given time, the status of the data collection effort can be viewed and communicated to others. The collected data is placed in a secure virtual container called a Logical Evidence File, and the data can be further analyzed through EnCase^® software or can then be uploaded to third-party eDiscovery attorney review platforms.

Automated Incident Response Suite (“AIRS”) is an add-on to the EnCase^® Enterprise solution that enables both reactive and proactive incident response.

For reactive incident response, AIRS integrates with the information security alerting systems of our customers, which include data leakage prevention, intrusion detection, and enterprise security management products. AIRS enables an organization to automate the traditionally time-consuming process of incident detection and response. With AIRS, alerts trigger automated retrieval of volatile data, and can also retrieve hard drive data to search for malware, including hidden processes such as rootkits, keystroke loggers and other forms of spyware. Rootkits are typically hidden applications that provide ongoing and unauthorized access to computers. Keystroke loggers are applications that record the computer user’s keystrokes and deliver the information to a third party. Spyware is any application that is installed without the computer user’s informed consent, and has the ability to change, collect, and transmit information about the user’s activities to a third party. Each event from the alerting system sent to AIRS goes through a two-step triage process to filter out false positives and assess whether a computer was actually compromised. AIRS can then delete the malware from the affected servers, desktops, and laptops. In addition, depending on the severity of the event, as defined by the alerting system and the initial triage, AIRS automatically follows up with additional data retrieval to identify any activity that has occurred on the affected servers, desktops, and laptops after the initial triggering event. The event data from the alerting system and the supporting near-time data collected by AIRS is aggregated into a database that enables thorough analysis by incident responders and security analysts.

For proactive incident response, a customer can use AIRS to sweep its network to identify and delete malware from its servers, desktops, and laptops. Most information security products, such as anti-virus, host intrusion detection and personal firewall software, cannot detect many of the hidden processes that AIRS can

identify and remediate. In addition, since AIRS can be used on a proactive basis, our customers can track the frequency and severity of their malware outbreaks.

EnCase^® Forensic software is the leading tool for searching, collecting, preserving and analyzing computer forensic data and authenticating such data in court. EnCase^® Forensic enables an investigator to conduct the full array of forensic functions on a single machine while preserving the integrity of the evidence for future use in court. Used by investigators and consultants in law enforcement, government agencies, small businesses, consulting firms and corporations, EnCase^® Forensic software provides a robust way to authenticate, search and recover computer evidence rapidly and thoroughly.

EnCase^® Forensic has the same capabilities as the Examiner in our EnCase^® Enterprise software, other than the capability to search across networks. Computer evidence recovered with EnCase^® Forensic software has been accepted and admitted into thousands of court proceedings in several countries.

FastBloc^® hardware and software is used to connect EnCase^® Forensic to a hard drive to which investigators have physical access. FastBloc^® hardware acts as a middleman between the operating system and the hard drive and physically blocks any hard drive write requests. This is a failsafe system primarily used by law enforcement and non-enterprise class investigations that provides an extra level of protection against damaging original evidence in cases that require such measures.

In 2006, we released FastBloc^® SE, the first commercial software write-blocking solution that allows EnCase^® software to take full control of IDE, SATA and SCSI channels on particular PCI controller cards, as well as the FireWire and USB ports from Windows, thereby permitting an extra level of protection against damaging original evidence without the use of hardware write-blocking devices. In addition, FastBloc^® SE allows forensic investigators or consultants to override and access host-protected areas and device configuration overlays.

Information Assurance Suite. We have recently introduced for sale to government organizations our EnCase^® Information Assurance Suite. The suite is comprised of four key subcomponents:

Cell Phone Solution. We are in the process of developing an investigative solution where our court-accepted EnCase^® Forensic technology can be used to help investigators recover, search, analyze and report on cellular phone data.

Our Professional Services Division provides various consulting services to our clients, including eDiscovery, Network Security Incident Response, Civil/Criminal digital investigation and implementation services. In addition, we offer certain packaged services based on the specific needs of our customers.

eDiscovery. Our consultants provide professional eDiscovery services to clients. Using the power of the EnCase^® Enterprise and eDiscovery Suite software, our consultants are able to significantly reduce the amount of data collected, thereby reducing the costs and time of processing, hosting, reviewing and producing data relevant to a particular discovery request.

Network Security Incident Response. We provide sophisticated network security incident response services to our clients. Using EnCase^® Enterprise software, including SnapShot, our consultants seek to locate the data that tells what really happened in a security breach, and to pinpoint the actual method of entry. Our consultants also provide customized EnScript^® programming language development, integration services with respect to information security alerting systems, and can also remediate any unknown or malicious processes.

Civil/Criminal Digital Investigations. We employ a team of trained criminal/civil computer investigation consultants, many from law enforcement or military backgrounds, who are skilled at conducting computer forensics analysis. Our computer forensics consulting engagements range from straightforward human resources or computer misuse matters to far-reaching complex intellectual property theft investigations. Our consultants also provide expert testimony and present evidence in connection with digital investigations.

Implementation of EnCase^® Enterprise. We provide implementation and consulting services in connection with the deployment of our EnCase^® Enterprise software. Our implementation typically takes three to ten days, during which we conduct performance tests to ensure full functionality and integration with existing systems in the organization and provide on-site training to ensure our customers can maximize the use of the EnCase^® Enterprise technology. Our consultants work with our customers to provide customized solutions tailored to the needs of each organization, and our consultants are encouraged to recommend our add-on products to our customers in order to further enhance the capabilities of our EnCase^® Enterprise software.

Packaged Consulting Services. We also offer pre-packaged services to serve specific customer needs.

Customers typically purchase software maintenance with each new product license. Customer support generally involves software updates, telephone and e-mail support, on a 24 hour per day, 5 days per week basis, as well as customer self-service on our website. Customers are typically provided an option to renew their maintenance agreements on an annual basis. Our technical support organization provides product support to our

current customers on a single-tiered offering and includes support availability 24 hours per day, 7 days per week, in English, and is also available during normal business hours in several other languages, including Japanese, Chinese, German and Spanish.

Our Training Division trains thousands of students per year in computer forensics principles and the use of our EnCase^® software. Because of the sensitive nature of digital investigations and the need to conduct digital investigations in a forensically sound manner, our users will typically take one or more of our courses. We provide an array of training courses on topics such as computer forensics, digital investigations, the proper use of our software products and the EnScript^® programming language, which teach our customers’ IT and data security professionals the basic principles of computer forensics, train them on the basic and advanced capabilities of our software products and teach them to write EnScript^® programs. We have retained third-party training partners in order to provide training around the world. Our extensive training program has enabled us to create a human capital knowledge base that can expand the recognition and demand for our products and services.

We operate two training classrooms in Pasadena, California, two near Washington, D.C., and one near London, England. In addition, our authorized training partners offer certain courses in the U.S., Canada and Australia. In 2005, we conducted training classes in 19 different countries. In addition to offering courses in English, we have begun to localize our courses by converting the course content and manuals into other languages, and delivering the courses in those languages. To date, we have created courses in German, Spanish, Korean and Japanese, and are currently developing courses in Chinese.

Each of our courses involves 32 hours of classroom instruction. Many of our courses are eligible for credit from a variety of organizations, including the State Bar of California, the International Information Systems Security Consortium, Inc., the National Association of State Boards of Accountancy, Association of Certified Fraud Examiners, the Texas Commission on Law Enforcement and the California Commission on Peace Officer Standards and Training. We are continually expanding our training offerings and we believe that we are the leading corporate provider of this type of digital investigation training.

EnCase^® FIM v5 (Field Intelligence Model/Mobile EE) Live Forensic Investigations

The EnCE™ program certifies the competency of public and private sector employees in the best practices of computer forensic investigations and in the proper use of our EnCase^® software products while conducting such investigations. In order to obtain EnCE™ certification, professionals must have at least 18 months of total investigative experience with at least six months experience in computer forensic investigations, complete extensive training requirements and pass a dual-phase EnCE™ examination. EnCE™ certification acknowledges that professionals have mastered computer forensic investigation methodology as well as the use of EnCase^® software during complex computer examinations. Our EnCE™ program is recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, and EnCE™ certification illustrates that an investigator is a skilled computer examiner. As of August 31, 2006, there were approximately 860 people worldwide who had achieved EnCE™ certification.

Both our EnCase^® Enterprise and EnCase^® Forensic software share three primary components of our technology.

Our EnCase^® Evidence File and EnCase^® Logical Evidence File are proprietary solutions that streamline the collection and preservation of digital evidence in investigations. The Evidence File authenticates the digital evidence by verifying that the digital fingerprint and checksums of small blocks of the collected data matches up with the original data. Our technology can verify the data on-the-fly, such that when a user attempts to view any portion of the evidence, it is instantly verified for authenticity first. By collecting the digital evidence from the investigator at the time of collection and writing that data into our EnCase^® Evidence Files, we are able to track the chain-of-custody and significantly reduce the burden on the investigator to authenticate the evidence in court. Our customers can use our EnCase^® Logical Evidence File to store individual files or fragments of data and preserve them in the Logical Evidence File. The EnCase^® Logical Evidence File is a significant component of our eDiscovery products and services.

While most software applications interact and work within the operating system, we have designed our software to run “beneath” the operating system in order to prevent interference from the operating system and ensure that data is not tampered with or modified. By working beneath the operating system, our technology accesses the hard drive at the sector level, which is the smallest writeable area on a hard drive. It reads data from the sectors on the hard drive in a raw format and makes the entire hard drive accessible to the user of our software, including all files and obscure areas. Importantly, areas of the hard drive that common users cannot access, such as unallocated space and unformatted space are also made accessible through our technology. While scanning the hard drive, our technology does not modify the metadata, such as filenames, dates, and times, on live systems, which enables our customers to conduct a complete examination of all the data on the hard drive

while assuring that the impact on the overall computing environment is substantially non-invasive. This process is critical in order to preserve the forensic integrity of the preserved data.

We have designed a proprietary advanced programming language called EnScript^® that permits the development of applications that run inside the EnCase^® software environment. EnCase^® software acts as the operating system for these applications. The EnScript^® language is optimized for our software and enables our users to quickly write powerful applications that are highly customized to their needs. The EnScript^® language permits not only Guidance Software to develop these applications, but also any other highly skilled programmer, organization or customer who so desires. The EnScript^® program can be compiled so the source code is not available to others, thereby allowing developers and organizations to protect their intellectual property. In addition to our own development efforts, EnScript^® programs are commonly developed by persons not affiliated with Guidance Software, and are distributed throughout the different investigative communities and organizations.

Our EnCase^® Enterprise software extends the capabilities of our EnCase^® Forensic software to enable our customers to scan hundreds of thousands of servers, desktops and laptops over a network to provide scalable enterprise-class performance. Using EnCase^® Enterprise, our customers can focus on the computers in question in a massive enterprise-scale investigation or emergency, analyze data or files on a network, including volatile memory using SnapShot, and preserve only the data necessary for the investigation into our EnCase^® Logical Evidence File. To accomplish this network-level capability securely, we designed and patented a security architecture that is based on a three-tier structure, which includes a Servlet, an Examiner and a SAFE server.

Designed to work across multiple operating systems, our EnCase^® Enterprise serves as an investigative platform, the foundation of an enterprise investigative infrastructure, when fully implemented on a network. Our software is currently compatible with many systems, such as:

We sell our product offerings directly to customers using our direct sales representatives and our internal sales staff and indirectly through third-party value-added resellers, or VARs. As of August 31, 2006, we employed 121 individuals who were involved in our selling and marketing efforts, and had agreements with over 50 third-party distributors.

The sales model for our EnCase^® Enterprise products and services involves a high degree of specialization based on the size and sales focus of the target customer. We primarily utilize direct sales field representatives to sell our EnCase^® Enterprise products and related services to large and mid-market corporate customers, which we classify as customers with at least $250 million in revenues that are not assigned to specific sales persons. For our largest corporate customers, individual members of our sales force generally target a named list of accounts and work to develop and cultivate long-term relationships with the companies they contact. For our mid-market corporate customers, our direct sales representatives focus on specific regions and certain named accounts in those regions and work to develop relationships in each region. Our internal sales staff is responsible for sales of our EnCase^® Enterprise products and related services to companies that are not large enough to fall within the mid-market customer group.

Our internal sales staff is also generally responsible for the sales for our EnCase^® Forensic products and our training services. A large portion of the business for our EnCase^® Forensic product is generated from pre-existing relationships, allowing our internal sales personnel to execute at a high level of efficiency. Our internal sales personnel spend the bulk of their time targeting our EnCase^® Forensic product to law enforcement agencies.

In addition to our corporate sales field representatives and our internal sales force, we have a sales team dedicated to our federal customers, a professional services sales force designed to specifically promote sales of professional services to new and existing customers, and a law firm sales force targeted at selling to law firm customers and strategic partners. These teams use a direct sales model to focus on those specific verticals given the unique selling dynamics that exist in each target market.

In 2005, we commenced a focused effort to expand international sales. International sales constituted approximately 25% of our sales in 2005. Outside of the United States, excluding the United Kingdom, we typically utilize third-party VARs to sell our products to our international customers. In the United Kingdom, we utilize a direct sales model similar to the system in place in the United States.

We believe that organizations can realize significant benefits by installing EnCase^® Enterprise across their networks as a foundation to build an enterprise investigative infrastructure. Our marketing strategy involves communicating the value of our products as the foundation on which to build an enterprise investigative infrastructure to organizations.

We direct our marketing resources heavily towards focused events programs, where we sponsor networking seminars in different geographic regions where C-level executives and prospective customers can learn from high profile industry individuals about important topics in the digital investigation industry. Our annual user conference, Computer and Enterprise Investigations Conference, also provides a valuable forum for users to connect, share information and learn about important topics in the industry.

Our marketing strategy mirrors our sales strategy in that it is segmented by product offering and target market. In marketing our EnCase^® Forensic product, we attempt to maximize our brand recognition by introducing new products and features to our established domestic customer base and by focusing our marketing efforts on foreign markets. We place great emphasis on mass marketing techniques such as webinars, e-mails and regional events to showcase our technology and product offerings. For our EnCase^® Enterprise products and related services, we tailor our marketing strategy to each target market segment.

Often, customers of our EnCase^® Enterprise product begin with an introductory bundle that consists of one SAFE, one Examiner and three Concurrent Connections and, as they expand their use of the software and build their enterprise investigative infrastructure, they purchase additional components. We price EnCase^® Enterprise primarily by component (such as the number of SAFEs, Examiners, and Concurrent Connections each customer purchases), although for smaller customers there is a pricing option available based on the size of the customer’s computer network (such as the number of servers, desktops and laptops on the customer’s network). In most instances, however, the Servlet is freely deployable at no charge, because we want to encourage our customers to deploy EnCase^® Enterprise to every server, desktop and laptop on their networks. The eDiscovery Suite and Automated Incident Response Suite are each priced based on the size of the customer’s computer network.

We price EnCase^® Forensic in two different ways. First, to the law enforcement and government market it is sold at a fixed price with bundled maintenance fees, with periodic upgrades that must be purchased separately if the customer wishes to continue to receive support and product upgrades beyond 12 months from purchase. Second, to the corporate market it is sold at a fixed price with maintenance fees required for support and product

upgrades. In addition, we offer a Premium License Support Program, which is a subscription arrangement entitling the customer to receive unspecified future products and post-contract customer support for a period of several years. If a customer purchases our Premium License Support Program, an annual payment option or a lump sum payment option is available.

Consulting and implementation services are typically billed on a per hour or per disk drive basis or are provided under fixed fee arrangements depending on the scope and size of each individual project.

Our customers include government agencies and global corporations in a wide variety of industries such as financial and insurance services, technology, defense contracting, telecom, pharmaceutical, manufacturing and retail. Our EnCase^® Enterprise customer base currently includes more than 90 of the Fortune 500 and many federal and international government agencies, and we have deployed approximately 24,000 units of our EnCase^® Forensic software to more than 1,000 government and law enforcement agencies and other customers worldwide. Our EnCase^® Enterprise customers are primarily in North America, and also extend to Europe, Africa, the Middle East and Asia/Pacific Rim. Sales to customers outside of the United States accounted for 25%, 23% and 25% of our revenues for the fiscal years ended December 31, 2003, 2004 and 2005, respectively. The majority of our EnCase^® Forensic customers are national and local government agencies, law enforcement agencies and other organizations of the United States government. No customer accounted for more than 10% of our total revenue in 2003, 2004 or 2005.

In the Laci Peterson murder investigation, the Sacramento Valley High Tech Task Force used EnCase^® Forensic on numerous personal and business computers used by Scott Peterson, a prime suspect in the murder of his wife. An in-depth analysis of Scott Peterson’s personal computer revealed Internet history records showing that a few weeks before his wife disappeared, Scott Peterson had searched the web for information on tides and water currents in the same bay where his wife’s body turned up five months later. Scott Peterson was convicted.

In the BTK case, an individual, known as the BTK killer, murdered 10 known victims in the Wichita, Kansas area. Although he taunted the police with clues and puzzles, he successfully evaded capture for over 30 years. In February, 2005, he taunted police again with more information, which he mailed to a local news station on a floppy diskette from a computer. Using EnCase^® Forensic, police were able to recover deleted files that included the name and address of the computer’s owner. Dennis Rader was subsequently arrested and later convicted.

We believe superior customer support is important to retaining and expanding our customer base. In addition to our comprehensive technical support offerings that assist customers in maximizing the value they get from our product and services, we have created our customer satisfaction program. This program assigns one of our executive sponsors to certain key accounts to maintain direct and formal post-sale interactions, including planned follow-ups with customers after implementation, both on-site and via teleconference. Further, our professionally trained personnel assist in the use of the EnScript^® programming language to help automate manual tasks.

Our research and development effort is focused on the advancement of our core products and the development of new products, as well as the quality assurance of both core and new products. We conduct research on existing or new computer hardware or software technology to develop solutions for our law enforcement, government or corporate markets. We conduct research on file system support, search and analysis algorithms, hardware engineering and design, industry standards, technology integrations and user productivity and performance features. Our research and development efforts are often aimed at creating new standards in our industry and streamlining current processes. Under our customer contracts, we typically obtain the rights to use any improvements to our technology developed or discovered on a particular customer deployment on other customer deployments. Our research and development expense was $3.3 million in the six months ended June 30, 2006, $4.9 million in 2005, $3.7 million in 2004 and $2.1 million in 2003.

The market for digital investigation solutions is extremely competitive, highly fragmented and subject to rapidly changing technology, shifting customer needs and frequent introductions of new products and services. We expect the intensity of competition to increase in the future as new companies enter our markets, existing competitors develop stronger capabilities, and as we expand into other markets. Many of our current competitors have longer operating histories, greater name recognition, access to larger customer bases and substantially more extensive resources than we have. They may be able to devote greater resources to the development, promotion and sale of their products than we can to ours, which could allow them to respond more quickly than we can to new technologies and changes in customer needs and achieve wider market acceptance. We expect to continue to face competition from new entrants.

We compete directly with a significant number of established companies that have developed or are developing and marketing software and applications that currently compete or will compete with our product and service offerings. While no single company competes with us across all of our markets, we face significant competition in each of the core markets in which we operate. Our current principal competitors include:

We also compete indirectly with a significant number of established companies or organizations that have developed or are developing and marketing software or services that may diminish the need for our solutions or the budget available to our customers to purchase our solutions. Our current principal indirect competitors include:

Our intellectual property rights are important to our business. We rely on a combination of copyright, trade secret, trademark, and patents, as well as confidentiality procedures and contractual provisions, to protect our proprietary technology, processes, and intellectual property. We currently have one U.S. patent (U.S. Patent No. 6,792,545) and nine patent applications pending in the United States, the European Union or under the Patent Cooperation Treaty (often more than one pending application relates to a single invention). We currently have registered trademarks or trademarks in the United States and in certain other jurisdictions, including the mark EnCase^® in the United States, Japan, and the European Union, and in the marks EnScript^® and FastBloc^® and CEIC^® in the United States. We currently have a pending trademark application for the EnCE™ mark in the United States.

Others may develop products that are similar to our technology. We generally enter into confidentiality and other written agreements with our employees and partners, and through these and other written agreements, we attempt to control access to and distribution of our software, documentation and other proprietary technology and other information. Despite our efforts to protect our proprietary rights, third parties may, in an unauthorized manner, attempt to use, copy or otherwise obtain and market or distribute our intellectual property rights or technology or otherwise develop a product with the same functionality as our software. Policing unauthorized use of our software and intellectual property rights is difficult, and nearly impossible on a worldwide basis. Therefore, we cannot be certain that the steps we have taken or will take in the future will prevent misappropriation of our technology or intellectual property rights, particularly in foreign countries where we do business or where our software is sold or used, where the laws may not protect proprietary rights as fully as do the laws of the United States or where the enforcement of such laws is not common or effective.

Substantial litigation regarding intellectual property rights exists in the software industry. From time to time, in the ordinary course of business, we are subject to claims relating to our intellectual property rights or those of others, and we expect that third parties may commence legal proceedings or otherwise assert intellectual property claims against us in the future, particularly as we expand the complexity and scope of our business, the number of similar products increases and the functionality of these products further overlap. These claims and any resulting litigation could subject us to significant liability for damages. In addition, even if we prevail, litigation could be time-consuming and expensive to defend and could affect our business materially and adversely. Any claims or litigation from third parties may also limit our ability to use various business processes, software and hardware, other systems, technologies or intellectual property subject to these claims or litigation, unless we enter into license agreements with the third parties. However, these agreements may be unavailable on commercially reasonable terms, or not available at all.

As of August 31, 2006, we employed 296 full-time employees, including 53 in research and development, 121 in selling and marketing and 46 in our Professional Services Division. We have never had any work stoppage and none of our employees are represented by a labor organization or are party to any collective bargaining arrangements. We consider our employee relations to be good.

Our corporate headquarters is located in Pasadena, California and we maintain offices near San Francisco, California, in Houston, Texas, in New York, New York, near Washington, D.C., and near London, England.

We lease approximately 85,000 square feet of space for our corporate offices in two locations in Pasadena, California. We also lease small regional facilities near San Francisco, California, in Houston, Texas, in New York, New York, near Washington, D.C., and near London, England. Our leases expire at various points through 2013. We believe that our current facilities are suitable and adequate to meet our current needs, and that suitable additional or substitute space will be available as needed to accommodate expansion of our operations.

We are from time to time a party to legal proceedings that arise in the normal course of business. We are not currently involved in any litigation, the outcome of which would, in management’s judgment based on information currently available, have a material adverse effect on our results of operations or financial condition, nor is management aware of any such litigation threatened against us.

The following table presents information with respect to our directors, executive officers and key employees as of August 31, 2006:

Shawn McCreight founded Guidance Software, Inc. in November 1997 and has served as Chairman of the Board of Directors since its inception. From January 2003 to present he has served as Chairman and Chief Technology Officer. Prior to January 2003, he served as Founder and Chief Executive Officer. Mr. McCreight has extensive experience in the designing and developing of software programs and applications, and was the principal developer of our EnCase^® software. Mr. McCreight received a B.A. in Physics from the University of California at Berkeley.

John Colbert has served as Chief Executive Officer since August 2004 and has served as a member of the Board of Directors since 2005. He previously held a number of executive positions at Guidance Software, Inc., including President and Chief Executive Officer from August 2004 to July 2005, Senior Executive Vice President from April 2004 to August 2004, Senior Vice President of Sales and Professional Services from July 2003 to April 2004, Vice President of Professional Services from March 2003 to July 2003, Vice President of Research and Development from March 2002 to October 2002, and Director of Training from June 2001 to March 2002. Prior to his service at Guidance Software, Inc., Mr. Colbert spent 14 years in law enforcement engaged in criminal investigations and computer forensic examinations.

Victor Limongelli has served as President since July 2005 and Secretary since August 2005. Previous to his appointment as President, Mr. Limongelli held a number of executive positions with Guidance Software, Inc., including Vice President of Professional Services and General Counsel from August 2004 to July 2005, and General Counsel from May 2003 to August 2004. Prior to joining Guidance Software, Inc., from February 2003 to April 2003 Mr. Limongelli served as Vice President and General Counsel for Fusura LLC, a web-based insurance business. From April 2000 to February 2003 he served as Vice President and General Counsel for Knowledge Networks, Inc., a web-enabled marketing information company. For approximately five years in the 1990s he practiced as an attorney at Morgan Lewis & Bockius LLP. Mr. Limongelli received an A.B. from Dartmouth College and a J.D. from Columbia University.

John Patzakis has served as Vice Chairman and Chief Legal Officer since August 2004. Previous to his appointment as Vice Chairman and Chief Legal Officer, Mr. Patzakis held a number of executive positions with Guidance Software, Inc., including President and Chief Executive Officer from January 2003 to August 2004,

and President and General Counsel from December 1999 to January 2003. Prior to his tenure at Guidance Software, Inc., Mr. Patzakis was a partner at the law firm he founded, Corey & Patzakis. He received a B.A. from the University of Southern California and a J.D. from Santa Clara University.

Frank J. Sansone has served as Chief Financial Officer since July 2005. Previous to his appointment as Chief Financial Officer for Guidance Software, Inc., from December 2002 to July 2005 Mr. Sansone held the position of Vice President of Finance. Prior to joining Guidance, from June 2000 to December 2002, following the acquisition of Petrolsoft Corporation, Mr. Sansone served as Director of Finance for Aspen Technology, Inc., an enterprise optimization software and services company specializing in supply chain management solutions. From November 1998 to May 2000, he served as Vice President of Finance for Petrolsoft Corporation, a privately held supply chain management software company, and from December 1993 to November 1998 he held various positions at PricewaterhouseCoopers, most recently as an Audit Manager. Mr. Sansone received a B.S. in Accounting from the University of La Verne and is a certified public accountant.

Kathleen O’Neil has served as a member of the Board of Directors for Guidance Software, Inc. since December 2005. She is currently the President and Chief Executive Officer for Liberty Street Advisors, LLC, where she has served since October 2001. Prior to Liberty Street Advisors, LLC, from January 2001 to September 2001, she served as General Manager of Global Financial Markets Infrastructure for IBM. From 1976 to 2000, Ms. O’Neil held a number of executive positions with the Federal Reserve Bank of New York. Ms. O’Neil has also served on the Board of Directors of BMC Software since November 2002 and the Board of Directors of MetLife Bank since 2004. Ms. O’Neil received a B.S. in Economics from John Carroll University, and received a Master in Business Administration from Wharton Graduate School of the University of Pennsylvania. She currently serves on the Board of John Carroll University.

Stephen Richards has served as a member of the Board of Directors for Guidance Software, Inc. since December 2005. From April 2001 to his retirement in December 2004, he held a number of executive positions with McAfee, Inc., including Chief Financial Officer and Chief Operating Officer. From April 1996 to March 2000 Mr. Richards also held a number of positions at E*TRADE Group, Inc., including Chief Financial Officer. From 1984 to 1996 he held a number of positions with The Bear Stearns Companies, Inc. including Chief Financial Officer of the Correspondent Clearing division. Mr. Richards received a B.A. in Statistics and Economics from the University of California at Davis and received a Masters in Business Administration from the University of California at Los Angeles. Mr. Richards is a certified public accountant.

George Tenet has served as a member of the Board of Directors for Guidance Software, Inc. since December 2005. Mr. Tenet is the former United States Director of Central Intelligence, and has served two Presidents. He was appointed by President Clinton in 1997 and served well into the first term of George W. Bush until July 2004, making him the second longest serving Director in CIA history. He is also a Member of the Board of Directors of Viisage Technology, Inc. and Chairman of the Board of CIA Memorial Foundation.

Amit Yoran has served as a member of the Board of Directors for Guidance Software, Inc. since August 2005. He has been the President of Yoran Associates since 2004. From January 2006 through April 2006, Mr. Yoran served as the CEO of In-Q-Tel. Mr. Yoran was also the former Bush Administration Chief of Cyber Security. President George W. Bush appointed Mr. Yoran as Director of the Department of Homeland Security’s National Cyber Security Division in 2003. Mr. Yoran’s number one directive was to coordinate responses among federal departments, law enforcement and intelligence agencies responsible for securing critical computer networks. Mr. Yoran also served as a conduit between the nation’s leading information technology companies and government agencies to develop leading technologies that improve detection and response to digital threats. Prior to joining the Bush Administration, Mr. Yoran was Vice President of Managed Security Services at Symantec Corporation, and was the founder and CEO of Riptech, an IT security company acquired by Symantec in 2002.

Sheldon Feinland has served as Vice President of Worldwide Sales since January 2006. Prior to his appointment as Vice President, Worldwide Sales, he served as the Director of North American Sales from June

2004 to January 2006. Prior to joining Guidance Software, Inc., from September 2003 to May 2004 Mr. Feinland served as Vice President of Americas Sales for Mantas Inc., a software and services company specializing in behavior detection solutions for the financial services industry. From August 2002 to August 2003 he served as Vice President of Enterprise Sales for Clearswift Corporation, a software and services company specializing in content security solutions. Prior to that, from September 2000 to July 2002, Mr. Feinland served as Vice President of North American Sales before being promoted to Vice President of Worldwide Sales for Whitelight Systems, Inc., an analytics software company supporting eBusiness solutions, and from 1998 to 2000, Mr. Feinland served as Vice President of Eastern Operations for Comshare Incorporated, a business management software and services company. Mr. Feinland received a B.S. in Computer Science and Applied Mathematics from the State University of New York at Albany.

Michael Gurzi has served as Vice President of Professional Services since July 2005. Prior to his appointment as Vice President of the Professional Services Division for Guidance Software, Inc., from April 2005 to July 2005 he served as Senior Director for that Division. From May 2003 to April 2005 Mr. Gurzi served as Senior Forensic Examiner, before being promoted to Director of Professional Services in December 2005. Prior to joining Guidance Software, Inc. Mr. Gurzi spent 21 years in law enforcement with the Los Angeles County Sheriff’s Department where he served as a Senior Investigator in the Computer Crimes Unit. Mr. Gurzi received a B.S. in Criminal Justice Administration from California State University at Long Beach.

Mark Harrington has served as General Counsel since January 2006. Prior to his appointment as General Counsel, he served as Associate General Counsel from August 2004 to December 2005. He has also served as the Secretary of Guidance Software’s Canadian subsidiary since February 2006, and the Assistant Secretary of Guidance Software, Inc. since August 2005. Prior to joining Guidance Software, Inc., from March 2002 to July 2004 Mr. Harrington served as Division General Counsel and Senior Attorney for Intel Corporation, where he also served as Director of Business Law and Senior Attorney from March 2001 to March 2002. From March 1999 to March 2001, Mr. Harrington served as Senior Counsel, and before that, from June 1997 to February 1999, he served as Associate General Counsel for Trillium Digital Systems, Inc., a communications software solutions company which was acquired by Intel in 2000. Mr. Harrington received a B.A. in English from the University of California at Los Angeles, and received a J.D. from Southwestern University.

Timothy Leehealey joined Guidance Software, Inc. in November of 2003 as Vice President of Corporate Development and currently serves as the Vice President of Corporate Development and Marketing. Prior to joining Guidance Software, Mr. Leehealey was an equity analyst for three years at Wedbush Morgan Securities, covering the networking and security market. While at Wedbush Morgan, his coverage list included Symantec, McAfee, NetScreen, Juniper, F5, Secure Computing and others. Prior to Wedbush Morgan, Mr. Leehealey worked as a fixed income analyst at JPMorgan Investment Management. Mr. Leehealey received his CFA in 2000 and a B.S. in Computer Systems Engineering and in Economics from Stanford University.

Our Board of Directors currently consists of seven members. Prior to the completion of this offering, the board of directors may be divided into three classes, each serving staggered three-year terms:

If this classification occurs, only one class of directors would be elected at each annual meeting of our stockholders, with the other classes continuing for the remainder of their respective terms. There are no family relationships among any of our directors or executive officers.

We have recently created an audit committee, compensation committee and nominating committee. The composition and responsibilities of each committee are described below.

Our audit committee oversees our corporate accounting and financial reporting process and the audits of our financial statements. It evaluates the independent auditors’ qualifications, independence and performance, determines the engagement of the independent auditors, approves the retention of the independent auditors to perform any proposed permissible non-audit services, monitors the rotation of partners of the independent auditors on our engagement team as required by law, reviews our critical accounting policies and estimates, oversees our internal audit function, and discusses with management and the independent auditors the results of the annual audit and the review of our quarterly financial statements. The current members of our audit committee are Stephen Richards, who is the committee chair, Amit Yoran and Kathleen O’Neil. We believe that Mr. Richards and Ms. O’Neil qualify as audit committee financial experts under the SEC rules implementing Section 407 of the Sarbanes-Oxley Act of 2002. We have designated Mr. Richards as our audit committee financial expert. We believe that the composition of our audit committee meets the requirements for independence under the current requirements of the Sarbanes-Oxley Act of 2002 and SEC rules and regulations, and the functioning of our audit committee complies with the applicable requirements of the Sarbanes-Oxley Act of 2002 and SEC rules and regulations.

Our compensation committee reviews and recommends policy relating to compensation and benefits of our officers and employees, including reviewing and approving corporate goals and objectives relevant to compensation of the Chief Executive Officer and other senior officers, evaluating the performance of these officers in light of those goals and objectives, and setting compensation of these officers based on such evaluations. The compensation committee also will administer the issuance of stock options and other awards under our stock plans. The compensation committee will review and evaluate, at least annually, the performance of the compensation committee and its members, including compliance of the compensation committee with its charter. The current members of our compensation committee members are George Tenet, who is the committee chair, Amit Yoran and Kathleen O’Neil. We believe that the composition of our compensation committee meets the requirements for independence under and the functioning of our compensation committee complies with, the applicable requirements of the Sarbanes-Oxley Act of 2002 and SEC rules and regulations.

Our nominating committee identifies prospective board candidates, recommends nominees for election to our board of directors and provides oversight in the evaluation of our board of directors. The members of our nominating committee are Amit Yoran, who is the committee chair, George Tenet and Kathleen O’Neil.

None of the members expected to serve on our compensation committee is one of our officers or employees. No member of our board of directors and no member expected to serve on our compensation committee serves as a member of the board of directors or compensation committee of any entity that has one or more executive officers serving as a member of our board of directors.

Prior to the completion of this offering, we expect to adopt a compensation program for our non-employee directors. Currently, each of our non-employee directors is paid $10,000 annually, and received stock options ranging from 37,300 shares to 40,800 shares, pursuant to the terms of our 2004 Equity Incentive Plan.

The following table sets forth information concerning the compensation received for services rendered to us by our Chief Executive Officer and each of our four most highly compensated executive officers for each of the three years ended December 31, 2005:

We have entered into “at-will” employment agreements with each of John Colbert, Victor Limongelli, John Patzakis and Frank Sansone. These agreements contain no specified term of employment, but rather may be terminated by either party at any time, with or without cause or notice. Each of these agreements contains customary provisions protecting our and our clients’ intellectual property rights and confidential information. Additionally, all claims and disputes between such employees and us arising in connection with their employment agreements shall be subject to resolution through arbitration. The agreement covering Mr. Limongelli restricts him, for a period of two years following any termination of employment, (i) from soliciting our employees or consultants to terminate such relationships with us, and (ii) from soliciting any of our licensors, licensees or customers who are known to the executive with respect to any competitive products or services. The agreements covering Mr. Colbert, Mr. Patzakis and Mr. Sansone provide that these executives may not compete with us for a period of one year following any termination of employment.

We maintain an executive retention and severance plan (the “ERS Plan”) in which certain key employees, including Victor Limongelli and Frank Sansone, participate. Under the ERS Plan, upon a participant’s termination of employment within two years after a “change of control” (as defined in the ERS Plan), either by

us or any successor entity for any reason or as a result of the participant’s “constructive termination” (as defined in the ERS Plan, including certain reductions in a participant’s compensation, duties or responsibilities and certain relocations of the participant’s work location), the participant will become entitled to a lump-sum payment equal to twice the participant’s annual base salary, which payment will be grossed up to account for any taxes imposed on the payment under Section 280G of the Internal Revenue Code, in addition to continuation of medical, dental, vision, life and disability coverages for a period of two years after such termination of employment at the same cost to the participant as in effect upon such termination (together, the “Severance”). In addition, if a participant dies during the three months preceding or three months following a change of control or resigns voluntarily for any reason between the six-month and one-year anniversary of a change of control, we will pay the Severance to the participant (or the participant’s estate, as applicable). We must cause any potential acquirer to expressly assume the ERS Plan with respect to all participants as a condition to consummating a change of control.

The following table sets forth information as to options granted to the named executive officers during the year ended December 31, 2005. We have not granted any stock appreciation rights.

In July 2006 Victor Limongelli and Frank Sansone were granted options to purchase 40,000 and 25,000 shares of our common stock, respectively, at an exercise price of $10.75 per share, which equals the fair value of our common stock at the date of the grant.

Aggregated Option Exercises in Last Fiscal Year and Fiscal Year End Option Values

No options were exercised by the named executive officers during the fiscal years ended December 31, 2005 or 2004.

Prior to the completion of this offering, we intend to adopt an amendment and restatement of our Guidance Software, Inc. 2004 Equity Incentive Plan (the “2004 Plan”). The following is a summary of certain material terms of the 2004 Plan, as we expect it to be amended and restated.

The purposes of the 2004 Plan are to attract, retain and provide additional incentives to the best available personnel for positions of substantial responsibility and to promote the success of our business. The 2004 Plan provides for grants of incentive stock options to our employees and the employees of certain of our subsidiary corporations and grants of nonqualified stock options and rights to purchase restricted stock to our employees, officers, directors, and consultants and those of our subsidiaries.

Except with respect to grants to independent directors, the 2004 Plan administrator will be a committee of the Board consisting solely of two or more directors, each of whom is an “outside director,” within the meaning of Section 162(m) of the Code, a “non-employee director” within the meaning of Rule 16b-3, and qualifies as “independent” under the listing requirements of the NASDAQ Global Market. The full Board will administer the Plan with respect to all awards granted to independent directors. The Board may abolish the Committee at any time and revest in the Board the administration of the 2004 Plan, except with respect to matters which under Rule 166-3 of the Exchange Act, Section 162(m) of the Code, or otherwise, are required to be determined in the sole discretion of the Committee. The authority of the plan administrator includes, but is not limited to, the designation of participants, the granting of awards under and the determination of the terms and conditions applicable to such awards (such as the shares subject to awards, applicable exercise prices, vesting conditions and transfer restrictions), prescribing rules and forms to facilitate plan administration and making all other determinations and interpretations under the 2004 Plan, in each case subject to the terms of the 2004 Plan.

The total number of shares that may be issued or awarded under the 2004 Plan is 5,103,994 shares; however, our board of directors and stockholders have approved an increase in this award limit (i) to 5,932,067 shares on January 1, 2007, (ii) to 6,760,190 shares on January 1, 2008, and (iii) to 7,588,313 shares on January 1, 2009, and, at all times, remains subject to adjustment as described below. In addition, (a) shares subject to awards that expire or become unexercisable without being exercised, (b) shares of restricted stock that are repurchased by us at their original purchase price, and (c) shares that are delivered by a participant or withheld by us in payment of exercise price or tax withholding obligations will, in each case, become available for future grant under the 2004 Plan (unless the 2004 Plan has terminated). Following the expiration of a limited transition period after the consummation of this offering, no participant may be granted, in any calendar year, stock options or stock purchase rights covering more than 1,000,000 shares of our common stock. This transition period will expire upon earliest to occur of:

Participants may be granted options to purchase shares of our common stock, including incentive stock options, as defined under Section 422 of the Code, and nonqualified stock options, and each grant will be evidenced by a written stock option agreement. With limited exception for stock options granted in connection with a merger or other corporate transaction, the per share exercise price of stock options granted pursuant to the 2004 Plan may not be less than 100% of the fair market value of a share of our common stock on the date of grant. The term of any stock option granted under the 2004 Plan may not exceed ten years. In addition, no incentive stock option may be granted under the 2004 Plan to any person who, at the time of grant, owns stock possessing more than 10% of the total combined voting power of all classes of our stock or the stock of certain of our affiliates unless the option exercise price is at least 110% of the fair market value of a share of our common stock on the date of grant and the term of the stock option does not exceed five years from the date of grant. Notwithstanding a stock option’s designation as an incentive stock option, to the extent that the aggregate fair market value of the shares with respect to which a participant’s incentive stock options becomes exercisable for the first time during any calendar year exceeds $100,000, such excess will be treated as a nonqualified stock option. In no event may a participant exercise a stock option later than the expiration date set forth in the applicable stock option agreement.

The plan administrator may provide that a participant may exercise a stock option, in whole or in part, prior to the full vesting of the Option. In the event that any such early exercise options are granted, however, shares acquired upon the exercise of such option will be subject to forfeiture, transfer or other restrictions.

The plan administrator will determine the permissible methods of payment of the exercise price of stock options, which may include cash, shares of our stock with a fair market value on the date of delivery equal to the exercise price of the stock option or exercised portion thereof (including shares issuable upon exercise of the stock option) or other property acceptable to the plan administrator. However, no participant who is a member of our Board or one of our “executive officers” within the meaning of Section 13(k) of the Exchange Act will be permitted to pay the exercise price of a stock option using any method which would violate Section 13(k) of the Exchange Act. A stock option may not be exercised for a fraction of a share.

Participants may be issued shares of restricted stock pursuant to the grant of stock purchase rights under the 2004 Plan. Restricted stock grants may be made in such amounts and on such terms and conditions as determined by the plan administrator. Restricted stock awards will be evidenced by a written agreement which may provide for restrictions on transferability, the right to repurchase shares upon the occurrence of certain specified events (such as a participant’s termination, divorce, bankruptcy, or insolvency) and such other restrictions as the plan administrator may determine. These restrictions and rights may lapse separately or in combination and at such times, pursuant to such circumstances, in such installments, or otherwise, as the plan administrator determines. In addition, any participant who exercises an “early exercise” option prior to its vesting will be issued restricted shares subject to similar restrictions.

Options and stock purchase rights granted under the 2004 Plan may not be transferred except by will or by the laws of descent and distribution. During the participant’s lifetime, only the participant or participant’s legal representative may exercise an option or a stock purchase right or make any elections with respect to an option or a stock purchase right.

In the event that the plan administrator determines that any distribution, change in capitalization, or corporate transaction or event affects our common stock such that an adjustment is appropriate in order to

prevent dilution or enlargement of the benefits intended to be made available under the 2004 Plan or with respect to any option, stock purchase right, or restricted stock, then the plan administrator will equitably adjust (i) the number and kind of shares of common stock (or other securities or property) with respect to which options or stock purchase rights may be granted, (ii) the number and kind of shares of common stock (or other securities or property) subject to outstanding options, stock purchase rights, or restricted stock, and/or (iii) the grant or exercise price of any option or stock purchase right.

The plan administrator also has the authority under the incentive award plan to take certain other actions with respect to outstanding awards in the event of a corporate transaction or change in our corporate structure or capitalization, including provision for the cash-out, termination, assumption or substitution of such awards. If a change in control occurs and outstanding awards are not converted, assumed, or replaced by a successor entity, then immediately prior to the change in control such awards will become fully exercisable and all forfeiture restrictions on such awards will lapse.

No award may be granted under the 2004 Plan after the tenth anniversary of the date on which the Board adopts the Plan (as amended and restated). In addition, the Board has the authority to suspend, terminate, or amend the 2004 Plan at any time. No amendment, suspension, or termination may, however, impair any existing participant’s rights under the 2004 Plan or any award without the written consent of such participant. Additionally, no amendment will be effective unless approved by our stockholders if stockholder approval is required by law, and no action of our Board may, without stockholder approval, increase the maximum number of shares issuable under the 2004 Plan or extend the term of the 2004 Plan.

We intend to file with the Securities and Exchange Commission a registration statement on Form S-8 covering the shares of common stock issuable under the 2004 Plan. Shares of our common stock covered by this registration statement, including any shares of our common stock issuable upon the exercise of options or the vesting of restricted stock, will be eligible for transfer or resale without restriction under the Securities Act unless held by our affiliates.

Indemnification of Directors and Executive Officers and Limitation of Liability

We intend to reincorporate in Delaware prior to the completion of this offering. Section 145 of the Delaware General Corporation Law authorizes a court to award, or a corporation’s board of directors to grant, indemnity to directors and officers in terms sufficiently broad to permit such indemnification under certain circumstances for liabilities, including reimbursement for expenses incurred, arising under the Securities Act.

As permitted by the Delaware General Corporation Law, we anticipate that our Delaware certificate of incorporation, which will be effective upon the closing of this offering, will include a provision that permits the elimination of personal liability of our directors for monetary damages for breach of fiduciary duty as a director, to the fullest extent permitted by the Delaware General Corporation Law as it now exists or as it may be amended. The Delaware General Corporation Law permits limitations of liability for a director’s breach of fiduciary duty other than liability:

Such limitation of liability may not apply to liabilities arising under the federal securities laws and does not affect the availability of equitable remedies such as injunctive relief or rescission. In addition and in accordance with the Delaware General Corporation Law, our bylaws will also permit us to secure insurance on behalf of any officer, director, employee or other agent for any liability arising out of his or her actions in such capacity, regardless of whether indemnification would be permitted under the Delaware General Corporation Law. We also intend to obtain additional liability insurance for our directors and officers.

Upon completion of this offering, our bylaws will authorize us to indemnify our officers, directors, employees and agents to the fullest extent permitted by the Delaware General Corporation Law. Section 145 of the Delaware General Corporation Law will empower us to enter into indemnification agreements with our officers, directors, employees and agents. We currently have indemnification agreements with our directors and executive officers under California law and, prior to the completion of this offering expect to enter into separate indemnification agreements with our directors and executive officers under Delaware law to give such directors and executive officers additional contractual assurances regarding the scope of indemnification set forth in our certificate of incorporation and our bylaws and to provide additional procedural protections which may, in some cases, be broader than the specific indemnification provisions contained in the Delaware General Corporation Law. The indemnification agreements may require us, among other things, to indemnify such directors and executive officers against liabilities that may arise by reason of status or service as directors or executive officers and to advance expenses they incur as a result of any proceeding against them as to which they could be indemnified.

At present, there is no pending litigation or proceeding involving any of our directors, executive officers, other employees or agents for which indemnification is sought, and we are not aware of any threatened litigation or proceeding that may result in a claim for such indemnification.

The following table shows the beneficial ownership of our common stock on July 31, 2006 by:

Beneficial ownership, which is determined in accordance with the rules and regulations of the SEC, means the sole or shared power to vote or direct the voting or to dispose or direct the disposition of our common stock. The number of shares of our common stock beneficially owned by a person includes shares of common stock issuable with respect to options held by the person that are exercisable within 60 days. The percentage of our common stock beneficially owned by a person assumes that the person has exercised all options the person holds which are exercisable within 60 days, and that no other persons exercised any of their options. Except as otherwise indicated, the business address for each of the following persons is 215 North Marengo Avenue, Pasadena, California 91101. Except as otherwise indicated in the footnotes to the table or in cases where community property laws apply, we believe that each person identified in the table possesses sole voting and investment power over all shares of common stock shown as beneficially owned by the person. Percentage of beneficial ownership before the offering is based on shares of common stock outstanding as of July 31, 2006. Percentage of beneficial ownership after the offering is based on shares of common stock outstanding after the completion of this offering.

On September 26, 2003, Matthew Healey paid $2.25 million cash in exchange for 412,390 shares of our common stock, representing a number of shares equal to 2% of the common stock then outstanding, and a warrant for the purchase of 206,200 additional shares of common stock at an exercise price of $0.001 per share. This transaction was exempt from the registration requirements of the Securities Act in reliance on Section (4)(2) of the Securities Act. Matthew Healey later transferred the shares and the warrant to the Healey 2003 Family Trust. On July 1, 2006, the Healey 2003 Family Trust exercised the warrant to purchase 206,200 shares of common stock at an exercise price of $0.001 per share. Timothy Leehealey, our Executive Vice President of Corporate Development and Marketing, is Matthew Healey’s son and one of the beneficiaries of the Healey 2003 Family Trust.

Pursuant to the terms of an Investor’s Rights Agreement, dated as of September 26, 2003, by and between us and Mathew Healey (the “Investor’s Rights Agreement”), the Healey 2003 Family Trust, which will hold 618,590 shares of our common stock outstanding after the closing of this offering, will be entitled to certain rights with respect to the registration of those shares under the Securities Act. See “Description of Capital Stock—Registration Rights” for additional information.

On May 2, 2006, our founding stockholders, Shawn and Jennifer McCreight, contributed 2,062,000 common shares to us. The contribution was made as a result of a commitment by the founding stockholders, upon establishment of the 2004 Equity Incentive Plan, to fund the common shares underlying the initial 2,062,000 option grants.

Certain of our directors, officers and shareholders have guaranteed our loans, operating leases and capital leases, including personal guarantees by Shawn McCreight, Jennifer McCreight, John Colbert, John Patzakis, and Bob Sheldon for our $3 million revolving line of credit with Bank of the West and personal guarantees by Shawn McCreight and Jennifer McCreight for our $7 million lease agreement with The Walnut Plaza, our main Pasadena facility. In addition, Shawn McCreight, Jennifer McCreight and John Patzakis have personally guaranteed leases for computer equipment with Dell. None of these individuals have received compensation or have a reimbursement right from us for guaranteeing these loans, operating leases and capital leases. Upon execution of this offering the guarantee with Bank of the West will expire.

Prior to the pricing of this offering, we intend to enter into a tax matters agreement with our pre-IPO S Corporation stockholders whereby we agreed to indemnify and hold harmless our S Corporation stockholders for any increases in their tax liability for the periods during which we were an S Corporation, if, pursuant to a settlement, compromise or other agreement with the Internal Revenue Service or other relevant taxing authority or the filing of an amended tax return, our income includable in the stockholder’s tax return for such period is increased or the character of such income is modified.

In addition, pursuant to the tax matters agreement, we agreed to declare certain distributions to each of our S Corporation stockholders prior to the pricing of the offering. The final distribution to each of our existing stockholders will be in an amount equal to (i) that stockholder’s pro rata share of our paid-in capital and (ii) that

stockholder’s pro rata share of our net income includible in the stockholder’s income as a result of our S Corporation status for all taxable periods from and after October 1, 1998 through the day prior to the day that our status as an S Corporation terminates, less any distributions previously made to the stockholder by us with respect to such net income. The determination of our 2006 net income through the termination of our S Corporation status is based on our good faith estimate. If our actual net income, as finally determined, is greater than such estimate, we have agreed to pay such excess to our S Corporation stockholders. If our actual net income is less than such estimate, our S Corporation stockholders will not be required to reimburse such excess to us.

The tax matters agreement also provides for certain allocations of responsibility for the preparation and filing of tax returns and payment of taxes for the taxable period (and portions thereof) ending on the termination of our status as an S Corporation and for the taxable period (and portions thereof) commencing on the day of such termination.

Upon the closing of this offering, we will be authorized to issue 100,000,000 shares of common stock, par value $0.001 per share and 10,000,000 shares of preferred stock. The following is a summary description of the material terms of our capital stock upon completion of this offering. Our bylaws and our certificate of incorporation, to be effective after the closing of this offering, provide further information about our capital stock.

As of August 31, 2006, there were 18,801,565 shares of common stock outstanding held by approximately 31 stockholders of record. After giving effect to the sale to the public of the shares of common stock offered in this prospectus, there will be shares of common stock outstanding.

Voting. The holders of our common stock are entitled to one vote for each outstanding share of common stock owned by that stockholder on every matter properly submitted to the stockholders for their vote. Stockholders are not entitled to vote cumulatively for the election of directors.

Dividend Rights. Subject to the dividend rights of the holders of any outstanding series of preferred stock, holders of our common stock are entitled to receive ratably such dividends and other distributions of cash or any other right or property as may be declared by our board of directors out of our assets or funds legally available for such dividends or distributions.

Liquidation Rights. In the event of any voluntary or involuntary liquidation, dissolution or winding up of our affairs, holders of our common stock would be entitled to share ratably in our assets that are legally available for distribution to stockholders after payment of liabilities. If we have any preferred stock outstanding at such time, holders of the preferred stock may be entitled to distribution and/or liquidation preferences. In either such case, we must pay the applicable distribution to the holders of our preferred stock before we may pay distributions to the holders of our common stock.

Conversion, Redemption and Preemptive Rights. Holders of our common stock have no conversion, redemption, preemptive, subscription or similar rights.

Following this offering, our certificate of incorporation will authorize our board of directors, subject to limitations prescribed by law, to issue up to 10,000,000 shares of preferred stock in one or more series without further stockholder approval. The board will have discretion to determine the rights, preferences, privileges and restrictions of, including, without limitation, voting rights, dividend rights, conversion rights, redemption privileges and liquidation preferences of, and to fix the number of shares of, each series of our preferred stock. Accordingly, our board of directors could authorize the issuance of shares of preferred stock with terms and conditions that could have the effect of delaying, deferring or preventing a transaction or a change in control that might involve a premium price for holders of our common stock or otherwise be in their best interest.

Upon completion of this offering, the holder of an aggregate of 618,590 shares of our common stock, or % of our common stock outstanding after the closing of this offering, will be entitled to certain rights with respect to registration of those shares under the Securities Act. These shares are referred to as registrable securities. The holder of registrable securities possess registration rights pursuant to the terms of the Investor’s Rights Agreement between this holder of registrable securities and us. The Investor’s Rights Agreement provides that, beginning 180 days after the closing of this offering, this holder will have the right to require us to file on

Form S-3, when this form becomes available to us, a registration statement under the Securities Act to register all or any part of the registrable securities held by them, subject to certain conditions and limitations. We are not required to file a registration statement on Form S-3 if we have already effected a registration on Form S-3 at the request of the holders of shares having these registration rights in the 12-month period prior to the holder’s request. In addition, we may postpone the filing of a registration statement for up to 90 days once in any 12-month period if we determine that the filing would be seriously detrimental to us and our stockholders.

Delaware Anti-Takeover Law and Certain Provisions of our Certificate of Incorporation and Bylaws

Upon completion of this offering, we will be subject to the provisions of Section 203 of the Delaware General Corporation Law. In general, the statute prohibits a publicly held Delaware corporation from engaging in a “business combination” with an “interested stockholder” for a period of three years following the date that the stockholder became an interested stockholder, unless:

A “business combination” includes a merger, asset or stock sale or other transaction resulting in financial benefit to the stockholder. An “interested stockholder” is a person who, together with affiliates and associates, owns, or within three years prior, did own, 15% or more of a corporation’s outstanding voting stock. This provision may have the effect of delaying, deterring or preventing a change in control of us without further actions by our stockholders.

Upon completion of this offering, our Delaware certificate of incorporation and bylaws may include a number of provisions that may have the effect of deterring or impeding hostile takeovers or changes in control or management. These provisions may include:

Such provisions may have the effect of delaying or preventing a change in control.

We will apply to have our common stock approved for quotation on the NASDAQ Global Market under the symbol “GUID.”

Prior to this offering, there has not been any public market for our common stock, and we cannot predict the effect, if any, that market sales of shares of our common stock or the availability of shares of common stock for sale will have on the market price of our common stock. Nevertheless, sales of substantial amounts of our common stock in the public market, or the perception that such sales could occur, could adversely affect the market price of our common stock and could impair our future ability to raise capital through the sale of equity securities.

Upon completion of this offering, we will have a total of shares of common stock outstanding. Shares sold in this offering will be freely tradable without restriction or further registration under the Securities Act, except for any shares which may be held or acquired by our “affiliates,” as that term is defined in Rule 144 promulgated under the Securities Act, which shares will be subject to the volume limitations and other restrictions of Rule 144 described below. The remaining 18,801,565 shares of common stock outstanding will be deemed “restricted securities” as defined under Rule 144. Restricted securities may be sold in the public market only if registered under the Securities Act or pursuant to an exemption from such registration, including, among others, the exemptions provided by Rules 144, 144(k) and 701 promulgated under the Securities Act, summarized below.

Under the lock-up agreements described below and the provisions of Rules 144, 144(k) and 701, additional shares will be available for sale in the public market as follows:

Substantially all of our stockholders and option holders, and all of our executive officers and directors have each signed a lock-up agreement that, subject to certain exceptions, prevents them from selling any shares of our common stock or any securities convertible into or exercisable or exchangeable for shares of common stock for a period of not less than 180 days from the date of this prospectus without the prior written consent of Morgan Stanley & Co. Incorporated. This 180 day period may be extended if (i) during the last 17 days of the 180 day period we issue an earnings release or material news or a material event relating to us occurs; or (ii) prior to the expiration of the 180 day period, we announce that we will release earnings results during the 16 day period beginning on the last day of the 180 day period. The period of such extension will be 18 days, beginning on the issuance of the earnings release or the occurrence of the material news or material event. Morgan Stanley & Co. Incorporated may in its sole discretion and at any time without notice release some or all of the shares subject to lock-up agreements prior to the expiration of the 180-day period. When determining whether or not to release shares from the lock-up agreements, Morgan Stanley & Co. Incorporated will consider, among other factors, the stockholder’s reasons for requesting the release, the number of shares for which the release is being requested and market conditions at the time. See “Underwriters.”

In general, under Rule 144 as currently in effect, beginning three months after the date of this prospectus, a person or persons whose shares are aggregated, who has beneficially owned restricted shares for at least one year, including persons who may be deemed to be our “affiliates,” would be entitled to sell within any three-month period a number of shares that does not exceed the greater of:

Sales under Rule 144 are also subject to certain manner-of-sale provisions and notice requirements and to the availability of certain public information about us.

Under Rule 144(k), a person who is not deemed to have been one of our “affiliates” at any time during three months preceding a sale and who has beneficially owned the shares proposed to be sold for at least two years, including the holding period of any prior owner other than an “affiliate,” is entitled to sell these shares without complying with the manner-of-sale, public information, volume limitation or notice provisions of Rule 144.

Subject to certain limitations on the aggregate offering price of a transaction and other conditions, Rule 701 permits resales of shares issued prior to the date the issuer becomes subject to the reporting requirements of the Exchange Act pursuant to certain compensatory benefit plans and contracts, commencing 90 days after the issuer becomes subject to the reporting requirements of the Exchange Act, in reliance upon Rule 144 but without compliance with certain restrictions, including the holding period requirements. In addition, the SEC has indicated that Rule 701 will apply to typical stock options granted by an issuer before it becomes subject to the reporting requirements of the Exchange Act, along with the shares acquired upon exercise of these options, including exercises after the date the issuer becomes so subject. Securities issued in reliance on Rule 701 are restricted securities and, subject to the contractual restrictions described above, beginning 90 days after the date of this prospectus, may be sold by persons other than “affiliates” subject only to the manner-of-sale provisions of Rule 144 and by “affiliates” under Rule 144 without compliance with its one-year minimum holding period requirement.

MATERIAL UNITED STATES FEDERAL INCOME TAX CONSEQUENCES FOR NON-UNITED STATES HOLDERS

The following is a summary of certain material United States federal income tax consequences of the purchase, ownership and disposition of our common stock to non-United States holders (as defined below), but does not purport to be a complete analysis of all the potential tax considerations relating thereto. This summary is based upon the provisions of the Code, Treasury regulations promulgated thereunder, administrative rulings and judicial decisions, all as of the date hereof. These authorities may be changed, possibly retroactively, so as to result in United States federal income tax consequences different from those set forth below. This summary is applicable only to non-United States holders (as defined below) who hold our common stock as a capital asset. We have not sought any ruling from the Internal Revenue Service, or the IRS, with respect to the statements made and the conclusions reached in the following summary, and there can be no assurance that the IRS will agree with such statements and conclusions.

This summary also does not address the effect of the United States federal estate or gift tax laws or the tax considerations arising under the laws of any foreign, state or local jurisdiction. In addition, this discussion does not address tax considerations applicable to an investor’s particular circumstances or to investors that may be subject to special tax rules, including, without limitation:

YOU ARE URGED TO CONSULT YOUR TAX ADVISOR WITH RESPECT TO THE APPLICATION OF THE UNITED STATES FEDERAL INCOME TAX LAWS TO YOUR PARTICULAR SITUATION, AS WELL AS ANY TAX CONSEQUENCES OF THE PURCHASE, OWNERSHIP AND DISPOSITION OF OUR COMMON STOCK ARISING UNDER THE UNITED STATES FEDERAL ESTATE OR GIFT TAX RULES OR UNDER THE LAWS OF ANY STATE, LOCAL, FOREIGN OR OTHER TAXING JURISDICTION OR UNDER ANY APPLICABLE TAX TREATY.

For purposes of this discussion, you are a non-United States holder if you are a holder that, for United States federal income tax purposes, is not a United States person. For purposes of this discussion, you are a United States person if you are:

Following this offering, we do not intend to make any distributions on shares of our common stock. However, if we do make distributions on our common stock, those payments will constitute dividends for United States federal income tax purposes to the extent paid from our current or accumulated earnings and profits, as determined under United States federal income tax principles. To the extent those distributions exceed both our current and our accumulated earnings and profits, they will constitute a return of capital and will first reduce your basis in our common stock, but not below zero, and then will be treated as gain from the sale of stock.

Any dividend paid to you generally will be subject to United States withholding tax either at a rate of 30% of the gross amount of the dividend or such lower rate as may be specified by an applicable tax treaty. In order to receive a reduced treaty rate, you must provide us with an IRS Form W-8BEN or other appropriate version of IRS Form W-8 certifying qualification for the reduced rate.

Dividends received by you that are effectively connected with your conduct of a United States trade or business (and, if a tax treaty applies, are attributable to a United States permanent establishment maintained by you) are exempt from such withholding tax. In order to obtain this exemption, you must provide us with an IRS Form W-8ECI properly certifying such exemption. Such effectively connected dividends, although not subject to withholding tax, are taxed at the same graduated rates applicable to United States persons, net of certain deductions and credits. In addition, if you are a corporate non-United States holder, dividends you receive that are effectively connected with your conduct of a United States trade or business may also be subject to a branch profits tax at a rate of 30% or such lower rate as may be specified by an applicable tax treaty.

If you are eligible for a reduced rate of withholding tax pursuant to a tax treaty, you may obtain a refund of any excess amounts currently withheld if you timely file an appropriate claim for refund with the IRS.

You generally will not be required to pay United States federal income tax on any gain realized upon the sale or other disposition of our common stock unless:

We believe that we are not currently and will not become a USRPHC. However, because the determination of whether we are a USRPHC depends on the fair market value of our United States real property relative to the fair market value of our other business assets, there can be no assurance that we will not become a USRPHC in the future. Even if we become a USRPHC, however, as long as our common stock is regularly traded on an established securities market, such common stock will be treated as United States real property interests only if you actually or constructively hold more than 5% of such regularly traded common stock.

If you are a non-United States holder described in the first bullet above, you will be required to pay tax on the net gain derived from the sale under regular graduated United States federal income tax rates, and corporate non-United States holders described in the first bullet above may be subject to the branch profits tax at a 30% rate or such lower rate as may be specified by an applicable income tax treaty. If you are an individual non-United States holder described in the second bullet above, you will be required to pay a flat 30% tax on the gain derived from the sale, which tax may be offset by United States source capital losses. You should consult any applicable income tax treaties that may provide for different rules.

Generally, we must report annually to the IRS the amount of dividends paid to you, your name and address, and the amount of tax withheld, if any. A similar report is sent to you. Pursuant to tax treaties or other agreements, the IRS may make its reports available to tax authorities in your country of residence.

Payments of dividends made to you may be subject to information reporting and backup withholding unless you establish an exemption, for example by properly certifying your non-United States status on a Form W-8BEN or another appropriate version of IRS Form W-8. Notwithstanding the foregoing, backup withholding and information reporting may apply if either we or our paying agent has actual knowledge, or reason to know, that you are a United States person.

Payments of proceeds from a disposition of our common stock effected outside the United States by a non-United States holder made by or through a foreign office of a broker generally will not be subject to information reporting or backup withholding. However, information reporting (but not backup withholding) will apply to such a payment if the broker is a United States person, a controlled foreign corporation for United States federal income tax purposes, a foreign person 50% or more of whose income is effectively connected with a United States trade or business for a specified three-year period, or a foreign partnership with certain connections with the United States, unless the broker has documentary evidence in its records that the beneficial owner is a non-United States holder and specified conditions are met or an exemption is otherwise established.

Payments of proceeds from a disposition of our common stock by a non-United States holder made by or through the United States office of a broker is generally subject to information reporting and backup withholding unless the non-United States holder certifies as to its non-United States holder status under penalties of perjury or otherwise establishes an exemption from information reporting and backup withholding.

Backup withholding is not an additional tax. Rather, the United States income tax liability of persons subject to backup withholding will be reduced by the amount of tax withheld. If withholding results in an overpayment of taxes, a refund or credit may be obtained, provided that the required information is furnished to the IRS in a timely manner.

Under the terms and subject to the conditions contained in an underwriting agreement dated the date of this prospectus among us, the selling stockholders and the underwriters, the underwriters named below, for whom Morgan Stanley & Co. Incorporated, Lehman Brothers Inc., Wachovia Capital Markets, LLC, and A.G. Edwards & Sons, Inc. are acting as representatives, have severally agreed to purchase, and we and the selling stockholders have agreed to sell to them, severally, the number of shares indicated below:

The underwriters are offering the shares of common stock subject to their acceptance of the shares from us and the selling stockholders and subject to prior sale. The underwriting agreement provides that the obligations of the several underwriters to pay for and accept delivery of the shares of common stock offered by this prospectus are subject to the approval of certain legal matters by their counsel and to other conditions. The underwriters are obligated to take and pay for all of the shares of common stock offered by this prospectus if any such shares are taken. However, the underwriters are not required to take or pay for the shares covered by the underwriters’ over-allotment option described below.

The underwriters initially propose to offer part of the shares of common stock directly to the public at the initial public offering price listed on the cover page of this prospectus and part to certain dealers at a price that represents a concession not in excess of $ a share under the initial public offering price. After the initial offering of the shares of common stock, the offering price and other selling terms may from time to time be varied by the representatives.

We and the selling stockholders have granted to the underwriters an option, exercisable for 30 days from the date of this prospectus, to purchase up to an aggregate of shares of common stock at the public offering price set forth on the cover page of this prospectus, less underwriting discounts and commissions. The underwriters may exercise this option solely for the purpose of covering over-allotments, if any, made in connection with the offering of the shares of common stock offered by this prospectus. To the extent the option is exercised, each underwriter will become obligated, subject to certain conditions, to purchase about the same percentage of the additional shares of common stock as the number listed next to the underwriter’s name in the preceding table bears to the total number of shares of common stock listed next to the names of all underwriters in the preceding table. If the underwriters’ option is exercised in full, the total price to the public would be $ , the total underwriters’ discounts and commissions paid by us and the selling stockholders would be $ and $ , respectively, and the total proceeds to us and the selling stockholders would be $ and $ , respectively.

The underwriters have informed us that they do not intend sales to discretionary accounts to exceed 5% of the total number of shares of common stock offered by them.

The following table shows the per share and total underwriting discounts and commissions that we and the selling stockholders are to pay to the underwriters in connection with this offering. These amounts are shown assuming both no exercise and full exercise of the underwriters’ option to purchase additional shares of our common stock.

The estimated offering expenses payable by us, exclusive of underwriting discounts and commissions, are approximately $ .

We, the selling stockholders, all of our directors and officers and holders of substantially all of our outstanding stock and stock options have agreed that, without the prior written consent of Morgan Stanley & Co. Incorporated on behalf of the underwriters, we and they will not, during the period ending 180 days after the date of this prospectus:

whether any such transaction described above is to be settled by delivery of common stock or such other securities, in cash or otherwise. Subject to certain exceptions, these restrictions do not apply to:

provided that, in the case of each of the last four types of transactions, each donee or transferee agrees to accept the restrictions described in this paragraph and no filing under Section 16 of the Securities Exchange Act of 1934 reporting a reduction of beneficial ownership of shares of common stock is required or voluntarily made in connection with these transactions during this 180-day restricted period.

The 180-day restricted period described in the preceding paragraph will be extended if:

in which case the restrictions described in the preceding paragraph will continue to apply until the expiration of the 18-day period beginning on the issuance of the release or the occurrence of the material news or material event.

In order to facilitate this offering of the common stock, the underwriters may engage in transactions that stabilize, maintain or otherwise affect the price of the common stock. Specifically, the underwriters may sell more shares than they are obligated to purchase under the underwriting agreement, creating a short position. A short sale is covered if the short position is no greater than the number of shares available for purchase by the underwriters under the over-allotment option. The underwriters can close out a covered short sale by exercising the over-allotment option or purchasing shares in the open market. In determining the source of shares to close out a covered short sale, the underwriters will consider, among other things, the open market price of shares compared to the price available under the over-allotment option. The underwriters may also sell shares in excess of the over-allotment option, creating a naked short position. The underwriters must close out any naked short position by purchasing shares in the open market. A naked short position is more likely to be created if the underwriters are concerned that there may be downward pressure on the price of the common stock in the open market after pricing that could adversely affect investors who purchase in this offering. In addition, to stabilize the price of the common stock, the underwriters may bid for, and purchase, shares of common stock in the open market. Finally, the underwriting syndicate may reclaim selling concessions allowed to an underwriter or a dealer for distributing the common stock in this offering, if the syndicate repurchases previously distributed common stock to cover syndicate short positions or to stabilize the price of the common stock. These activities may raise or maintain the market price of the common stock above independent market levels or prevent or retard a decline in the market price of the common stock. The underwriters are not required to engage in these activities, and may end any of these activities at any time.

We will apply to have our common stock approved for quotation on the NASDAQ Global Market under the symbol “GUID.”

We, the selling stockholders and the underwriters have agreed to indemnify each other against certain liabilities, including liabilities under the Securities Act.

At our request, Morgan Stanley & Co. Incorporated has reserved for sale, at the initial public offering price, up to shares, or % of the shares, offered in this prospectus, for our directors, officers, employees, business associates and other related persons. The number of shares of common stock available for sale to the general public will be reduced to the extent that such persons purchase the reserved shares. Any reserved shares which are not so purchased will be offered by the underwriters to the general public on the same basis as the other shares offered in this prospectus. Employees, and immediate family members of directors, officers and employees, participating in the directed share program will be required to agree not to sell, transfer, assign, pledge or hypothecate shares acquired through the directed share program for a period of 180 days after purchasing the shares. Business associates and other persons participating in the directed share program will be required to make a similar agreement for a period of 90 days after purchasing the shares. This lock-up period will be extended if, during the last 17 days of the 180-day or 90-day restricted period we issue an earnings release or material news or a material event relating to us occurs, or prior to the expiration of the 180-day or 90-day restricted period we announce that we will release earnings results during the 16-day period beginning on the last day of the 180-day or 90-day period, in which case the restrictions described in the preceding sentence will continue to apply until the expiration of the 18-day period beginning on the issuance of the release or the occurrence of the material news or material event.

Prior to this offering, there has been no public market for the common stock. The initial public offering price will be determined by negotiations between us, the selling stockholders and the representatives of the underwriters. Among the factors to be considered in determining the initial public offering price will be our future prospects and those of our industry in general, our sales, earnings and certain other financial operating information in recent periods, and the price-earnings ratios, price-sales ratios and market prices of securities and certain financial and operating information of companies engaged in activities similar to ours. The estimated initial public offering price range set forth on the cover page of this preliminary prospectus is subject to change as a result of market conditions and other factors.

The validity of the issuance of the common stock offered by this prospectus and certain other legal matters in connection with the sale of the shares of common stock offered hereby will be passed upon for us by Latham & Watkins LLP, Los Angeles, California. Certain legal matters relating to the offering will be passed upon for the underwriters by Jones Day, Menlo Park, California.

The financial statements as of and for the year ended December 31, 2005 included in this prospectus and the related financial statement schedule included elsewhere in the registration statement have been audited by Deloitte & Touche LLP, an independent registered public accounting firm, as stated in their report appearing herein and elsewhere in the registration statement, and are included in reliance upon the report of such firm given upon their authority as experts in accounting and auditing.

The 2003 and 2004 financial statements and the related financial statement schedule appearing in this prospectus and registration statement have been audited by McGladrey & Pullen, LLP, an independent registered public accounting firm, as stated in their report appearing elsewhere herein, and are included in reliance upon such report and upon the authority of such firm as experts in accounting and auditing.

Our consolidated financial statements as of December 31, 2002, 2003 and 2004 and for the years then ended have been audited by McGladrey & Pullen, LLP. In March 2006, we engaged Deloitte & Touche LLP to audit our consolidated financial statements as of and for the year ended December 31, 2005. Our board of directors approved the appointment of Deloitte & Touche LLP as our independent registered public accounting firm in March 2006.

There were no disagreements at any time between McGladrey & Pullen, LLP and us on any matter of accounting principles or practices, financial statement disclosure or auditing scope or procedures. The audit report of McGladrey & Pullen, LLP did not contain any adverse opinion or disclaimer of opinion, nor was it qualified or modified as to uncertainty, audit scope or accounting principles. During the years ended December 31, 2002, 2003 and 2004, and through March 2006, we did not consult Deloitte & Touche LLP with respect to the application of accounting principles to a specified transaction, either completed or proposed, or the type of audit opinion that might be rendered on our consolidated financial statements, or any other matters or reportable events listed in Items 304(a)(2)(i) and (ii) of Regulation S-K.

We have filed with the SEC a registration statement on Form S-1 under the Securities Act that registers the shares of our common stock to be sold in this offering. This prospectus, filed as a part of the registration statement, does not contain all of the information set forth in the registration statement and exhibits and schedules, certain parts of which are omitted in accordance with the rules and regulations of the SEC. For further information about us and the shares to be sold in this offering, please refer to the registration statement. Statements contained in this prospectus as to the contents of any agreement or any other document referred to are not necessarily complete and, in each instance, we refer you to the copy of the agreement or other document filed as an exhibit to the registration statement. Each of these statements is qualified in all respects by this reference.

You may read and copy the registration statement and the exhibits and schedules to the registration statement at the public reference room maintained by the SEC at 100 F Street, N.E., Room 1580, Washington, D.C. 20549. Please call the SEC at 1-800-SEC-0330 for further information regarding the public reference room. You may also obtain copies of all or part of the registration statement by mail from the Public Reference Section of the SEC at prescribed rates.

The SEC also maintains a website that contains reports, proxy and information statements and other information about issuers, including Guidance, that file electronically with the SEC. The address of that site is www.sec.gov.

Upon completion of this offering, we will become subject to the reporting and information requirements of the Securities Exchange Act of 1934, as amended, and we will file reports, proxy statements and other information with the SEC.

We have audited the accompanying consolidated balance sheet of Guidance Software, Inc. and its subsidiary (the “Company”) as of December 31, 2005, and the related consolidated statement of operations, stockholders’ deficit, and cash flows for the year then ended. Our audit also included the financial statement schedule for the year ended December 31, 2005 listed in the Index at Item 16. These financial statements and financial schedule are the responsibility of the Company’s management. Our responsibility is to express an opinion on the financial statements based on our audit.

We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. The Company is not required to have, nor were we engaged to perform, an audit of its internal control over financial reporting. Our audit included consideration of internal control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Company’s internal control over financial reporting. Accordingly, we express no such opinion. An audit also includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audit provides a reasonable basis for our opinion.

In our opinion, such 2005 consolidated financial statements present fairly, in all material respects, the financial position of the Company as of December 31, 2005, and the results of its operations and its cash flows for the year then ended in conformity with accounting principles generally accepted in the United States of America. Also, in our opinion, such financial statement schedule for the year ended December 31, 2005, when considered in relation to the basic consolidated financial statements taken as a whole, presents fairly in all material respects the information set forth therein.

We have audited the accompanying consolidated balance sheet of Guidance Software, Inc. and subsidiary (the “Company”) as of December 31, 2004, and the related consolidated statements of operations, stockholders’ deficit, and cash flows for each of the two years in the period ended December 31, 2004. Our audits also included the financial statement schedule of the Company listed in Item 16. These financial statements and financial statement schedule are the responsibility of the Company’s management. Our responsibility is to express an opinion on these financial statements and schedule based on our audits.

We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 2004, and the results of its operations and its cashflows for each of the two years in the period ended December 31, 2004, in conformity with accounting principles generally accepted in the United States of America. Also, in our opinion, the related financial statement schedule, when considered in relation to the basic consolidated financial statements taken as a whole, presents fairly in all material respects the information set forth therein.

As discussed in Note 13 to the financial statements, the financial statements have been restated for errors in the application of accounting principles.

April 4, 2005, except for Notes 12 and 13, as to which the date is September 15, 2006

(Disclosure as of June 30, 2006 and for the six months ended June 30, 2005 and 2006 are unaudited)

Note 1. Description of the Business and Summary of Significant Accounting Policies

Guidance Software, Inc. and subsidiary (“Guidance” “We” or the “Company”) was incorporated in 1997 and is headquartered in Pasadena, California. Guidance is a global provider of software solutions to conduct digital investigations. The Company’s flagship product is EnCase^® Enterprise, a comprehensive, network-enabled digital solution that enables corporations and government agencies to search, collect, preserve and analyze data across all of the servers, desktops and laptops that comprise their entire network from a single location. We also sell EnCase^® Forensic, primarily for use by law enforcement and government agencies for collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court proceedings. We complement our software offerings with a comprehensive array of professional and training services including technical support and maintenance services to help our customers implement our solutions, conduct investigations and train their IT professionals to effectively and efficiently use our software products.

The accompanying consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States, or (“GAAP”). The consolidated financial statements include the accounts of Guidance and its wholly owned subsidiary. Guidance and its subsidiary are collectively referred to herein as the “Company.” All significant intercompany accounts and transactions have been eliminated.

The condensed consolidated financial statements as of June 30, 2006 and for the six months ended June 30, 2005 and 2006 are unaudited. In the opinion of management, the unaudited financial statements have been prepared on the same basis as the audited financial statements and include all adjustments, consisting of normal recurring adjustments, necessary for the fair presentation of the financial position and the results of operations as of such date and for such periods. Results of interim periods are not necessarily indicative of the results to be expected for the entire fiscal year.

The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and judgments that affect the reported amounts of assets, liabilities, revenues and expenses, and related disclosure of contingent assets and liabilities. On an ongoing basis, we evaluate these estimates, including those related to bad debts, income taxes, commitments, contingencies and litigation. We base our estimates on historical experience and on various other assumptions that are believed to be reasonable under the circumstances. Actual results may differ from these estimates.

The Company considers all highly liquid investments purchased with an original maturity of three months or less to be cash equivalents.

The carrying amounts of cash equivalents, accounts receivable, and accounts payable approximate fair value because of the short-term maturities of these instruments. Based on borrowing rates currently available to the Company for loans with similar terms, the carrying values of the Company’s notes payable and capital lease obligations also approximate fair value.

Trade receivables are carried at original invoice amount less an estimate made for doubtful receivables based on a review of all outstanding amounts. Management determines the allowance for doubtful accounts by regularly evaluating individual trade receivables and considering the customer’s financial condition and credit history. Trade receivables are written off when deemed uncollectible. A trade receivable is considered past due if any portion of the receivable balance is outstanding for more than 30 days unless special terms are provided.

Inventory is comprised of hardware and packaged software and valued at the lower of cost or market, using the first-in first out method.

The cost of property and equipment, less applicable estimated residual values, is depreciated over the shorter of their estimated useful lives or the life of the capital lease (if applicable), on the straight-line method, from the date the specific asset is completed, installed, and ready for use, as follows:

The Company reviews its long-lived assets in accordance with Statement of Financial Accounting Standards (“SFAS”) No. 144, “Accounting for the Impairment or Disposal of Long-Lived Assets”, which provides guidance on the recognition and measurement of the impairment of long-lived assets to be held and used, and the measurement of long-lived assets to be disposed of by sale. Long-lived assets are reviewed for impairment whenever events or changes in circumstances indicate that the carrying amount of an asset may not be recoverable. Recoverability of assets to be held and used is measured by a comparison of the carrying amount of the assets to future net cash flows (undiscounted and without interest) expected to be generated by the asset. If such assets are considered to be impaired, the impairment to be recognized is measured by the amount by which the carrying amount of the assets exceeds the fair value of the assets. Assets to be disposed of are reported at the lower of the carrying amount or fair value less costs to sell.

Financial instruments that potentially subject the Company to significant concentrations of credit risk consist primarily of cash and cash equivalents and accounts receivable. The Company restricts investments in cash and cash equivalents to financial institutions with high credit standing. At December 31, 2005, the majority of the Company’s cash and cash equivalents were held at financial institutions located in California. Accounts at these institutions are insured by the Federal Deposit Insurance Corporation up to $100,000. Uninsured balances aggregate approximately $6,899,000 as of December 31, 2005. The Company performs periodic evaluations of the relative credit standing of financial institutions and limits the amount of risk by selecting financial institutions with a strong credit standing. The Company periodically performs credit evaluations of its customers and maintains reserves for potential losses on its accounts receivable.

The Company generates revenues principally from the sale of its EnCase^® Enterprise Edition (“EEE”) and EnCase^® Forensic Edition (“EFE”) software products. The Company’s proprietary software is generally sold with one to three years of maintenance, which can be renewed at a stated renewal rate. Revenue associated with the sale of a software license is referred to as product revenue. Revenue associated with the sale of maintenance services is referred to as maintenance revenue. The Company also generates revenues from in-house training courses, implementation and consulting services, in which the Company assists customers with the performance of digital investigations and trains their IT professionals to use the Company software products, which are collectively referred to as services revenue. To a lesser extent, the Company also generates revenues from the sale of its Premium License Support Program (“PLSP”) and FastBloc^® hardware, which is also included in product revenues.

The Company applies the provisions of Statement of Position (“SOP”) 97-2, “Software Revenue Recognition,” as amended by SOP 98-9, “Modification of SOP 97-2, Software Revenue Recognition, With Respect to Certain Transactions.” For arrangements that contain a non-software deliverable such as hardware, the Company applies the provisions of Emerging Issues Task Force No. (“EITF”) 03-05 “Applicability of AICPA Statement of Position 97-2 to Non-Software Deliverables in an Arrangement Containing More-Than-Incidental Software” and recognizes revenue when all other revenue recognition criteria are met. While these statements govern the basis for revenue recognition, significant judgment and the use of estimates are required in connection with the determination of the amount of product revenues and services and other revenues as well as the amount of deferred revenue to be recognized in each accounting period.

Product revenue. The timing of product revenue recognition is dependent on the nature of the product sold. Product arrangements comprising multiple deliverables including software and hardware are generally categorized into one of the following:

Services and Maintenance Revenue. The majority of the Company’s training, consulting and implementation services, which we collectively refer to as services revenue, are performed under per hour, per disk drive or fixed fee arrangements. Revenue from such services is recognized as the services are provided.

Revenue related to technical support and software updates on a when-and-if available basis which we refer to as maintenance revenue is also included in services and maintenance revenue. The Company recognizes all maintenance revenue ratably over the applicable maintenance period. The Company determines the amount of maintenance revenue to be deferred through reference to substantive maintenance renewal provisions contained in multiple element arrangements. The Company considers substantive maintenance provisions to be provisions where the stated maintenance renewal as a percentage of the product fee is comparable to the normal pricing for maintenance only renewals.

Revenue Recognition Criteria. The Company recognizes revenue when persuasive evidence of an arrangement exists, the element has been delivered, the fee is fixed or determinable and collection of the resulting receivable is probable. A discussion about these revenue recognition criteria and their applicability to the Company’s transactions follows:

Deferred revenue consists primarily of payments received in advance of delivery of products and services associated with the sale of the Company’s PLSP and EFE product offerings. Deferred revenue also includes revenue related to undelivered elements that may or may not have been sold in conjunction with the sale of the EEE product for which VSOE of the undelivered elements exists.

Research and development costs consist primarily of salaries and other personnel-related costs, bonuses and facility costs. The Company maintains a research and development staff to enhance its products and to develop new products. In accordance with SFAS No. 86, “Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise Marketed,” software costs are expensed as incurred until technological feasibility of the software is determined and the recovery of the cost can reasonably be expected, after which any additional costs are capitalized. The Company has expensed all software development costs because the establishment of technological feasibility of products and their availability for sale have substantially coincided.

The Company records sales commissions when the commissions are earned, which is generally when the customer has been billed and collection is probable. Related revenue is recognized as described above.

The Company leases it facilities under operating leases, and accounts for those leases in accordance with SFAS No. 13, “Accounting for Leases”. For leases that contain rent escalation or rent concessions provisions, the Company records the total rent expense during the lease term on a straight-line basis over the term of the lease. The Company records the difference between the rent paid and the straight-line rent as a deferred rent liability in the accompanying consolidated balance sheets.

Advertising costs are charged to operations as incurred and were not significant for any period presented.

For federal and state income tax purposes, the Company has elected to be treated as an S Corporation under Subchapter S of the Internal Revenue Code (the “IRC”) and under applicable state income tax codes. Accordingly, the stockholders report their proportionate share of the Company’s taxable income on their individual income tax returns. Therefore, no provision or liability for federal income tax has been included in these financial statements. However, the Company is subject to income taxes in California, New York, New Jersey, Virginia, Texas and the United Kingdom and accordingly, a provision for these taxes is included in the accompanying financial statements.

In connection with the proposed initial public offering of its common stock, the Company anticipates that it will distribute to its current stockholders substantially all of the undistributed cumulative income that has been taxed or is taxable to its current stockholders. The distribution would have been approximately $1.6 million if it had been made at June 30, 2006. Actual cash distributions to current stockholders during the six months ending June 30, 2006 were $1,710,000.

On March 19, 2004, the Company’s board of directors declared a ten-for-one stock split of the Company’s ordinary shares. Stockholders of record as of the close of business on March 19, 2004 received nine additional shares for each one share held on the record date with distribution of the additional shares effected on March 19, 2004. Share, per share, and stock option data for all periods presented in the consolidated financial statements and related disclosures have been adjusted to give effect to the stock split.

Assets and liabilities denominated in foreign currencies are remeasured at the balance sheet date. Resulting exchange rate gains or losses are included as a component of current period earnings. No material gains or losses have been recorded.

The Company periodically evaluates all pending or threatened contingencies and any commitments, if any, that are reasonably likely to have a material adverse effect on its operations or financial position. The Company assesses the probability of an adverse outcome and determines if it is remote, reasonably possible or probable as defined in accordance with the provisions of SFAS No. 5, “Accounting for Contingencies.” If information

available prior to the issuance of the Company’s financial statements indicates that it is probable that an asset had been impaired or a liability had been incurred at the date of the Company’s financial statements, and the amount of the loss, or the range of probable loss can be reasonably estimated, then such loss is accrued and charged to operations. If no accrual is made for a loss contingency because one or both of the conditions pursuant to SFAS No. 5 are not met, but the probability of an adverse outcome is at least reasonably possible, the Company will disclose the nature of the contingency and provide an estimate of the possible loss or range of loss, or state that such an estimate cannot be made.

In February 2006, the Financial Accounting Standards Board (“FASB”) issued SFAS No. 155, “Accounting for Certain Hybrid Financial Instruments—an amendment of FASB Statements No. 133 and 140,” to simplify and make more consistent the accounting for certain financial instruments. Specifically, SFAS No. 155 amends SFAS No. 133, “Accounting for Derivative Instruments and Hedging Activities”, to permit fair value remeasurement for any hybrid financial instrument with an embedded derivative that otherwise would require bifurcation, provided that the whole instrument is accounted for on a fair value basis. SFAS No. 155 amends SFAS No. 140, “Accounting for the Impairment or Disposal of Long-Lived Assets”, to allow a qualifying special-purpose entity to hold a derivative financial instrument that pertains to a beneficial interest other than another derivative financial instrument. SFAS No. 155 applies to all financial instruments acquired or issued after the beginning of an entity’s first fiscal year that begins after September 15, 2006, with earlier application allowed. The Company does not expect the adoption of SFAS No. 155 to have a significant impact on the consolidated results of operations or the financial position of the Company.

In November 2004, the FASB issued SFAS No. 151, “Inventory Costs-an Amendment of ARB No. 43, Chapter 4.” SFAS No. 151 requires that accounting for items such as idle facility expense, freight, handling costs, and wasted materials (spoilage) be recognized as current period charges regardless of whether they meet the criterion of “so abnormal.” In addition, this Statement requires that allocation of fixed production overheads to the costs of conversion be based on the normal capacity of the production facilities. This Statement is effective for inventory costs incurred during fiscal years beginning after June 15, 2005. The provisions of this Statement are to be applied prospectively. We believe that the adoption of SFAS No. 151 will not have a material effect on our Consolidated Financial Statements.

In May 2005, the FASB issued SFAS No. 154, “Accounting Changes and Error Corrections,” (SFAS 154), which is a replacement of APB Opinion No. 20, “Accounting Changes,” and FASB Statement No. 3, “Reporting Accounting Changes in Interim Financial Statements,” (SFAS 3). SFAS 154 does not change the transition provisions of any existing accounting pronouncements, including those that are in a transition phase as of the effective date of SFAS 154. The Statement applies to all voluntary changes in accounting principle, and changes the requirements for accounting for and reporting of a change in accounting principle. SFAS 154 requires retrospective application prior periods’ financial statements of a voluntary change in accounting principle unless it is impractical. SFAS 154 is effective for accounting changes and corrections of errors made in fiscal years beginning after December 15, 2005. SFAS No. 154 will only affect the Company’s results of operations and financial condition if it implements changes in accounting principles that are addressed by the standard or corrects accounting errors in future periods.

In June 2006, the FASB issued FASB Interpretation (“FIN”) No. 48, “Accounting for Uncertainty in Income Taxes—an interpretation of FASB Statement No. 109.” The interpretation clarifies the accounting for uncertainty in income taxes recognized in a company’s financial statements in accordance with SFAS No. 109, “Accounting for Income Taxes.” Specifically, the pronouncement prescribes a recognition threshold and a measurement attribute for the financial statement recognition and measurement of a tax position taken or expected to be taken

in a tax return. The interpretation also provides guidance on the related derecognition, classification, interest and penalties, accounting for interim periods, disclosure and transition of uncertain tax positions. This interpretation is effective for fiscal years beginning after December 15, 2006. We are assessing FIN 48 and have not determined the impact that the adoption of FIN 48 will have on our consolidated financial statements.

The Company calculates net income (loss) per share in accordance with SFAS No. 128, “Earnings Per Share.” Under SFAS No. 128, basic net income per common share is calculated by dividing net income by the weighted-average number of common shares outstanding during the reporting period. Diluted net income per common share reflects the effects of potentially dilutive securities, which consist of stock options and a warrant issued in connection with the private placement of common stock (See Note 10). A reconciliation of the numerator and denominator used in the calculation of basic and diluted net income per share is as follows:

For each of the two years in the period ended December 31, 2004 and the six months ended June 30, 2006, weighted average shares of common stock issuable in connection with stock options, a warrant and unvested restricted shares of approximately 2,694,000, 1,094,000 and 1,551,000, respectively, were not included in the diluted earnings per share calculation as to do so would have been anti-dilutive.

Pro forma net income reflects the income tax benefit that would have been reported by the Company had it been subject to income taxes at the corporate level during all periods presented. Pro forma net income per share is computed by dividing the pro forma net income available to common stockholders for the period by the pro forma weighted average number of shares of common stock and potentially dilutive securities outstanding during the period.

Property and equipment, including assets held under capital leases as described in Note 7, consist of the following:

Depreciation and amortization expense related to property and equipment was $647,000, $1,158,000 and $1,356,000 for the years ended December 31, 2003, 2004 and 2005, respectively.

The Company elected to be treated as an S Corporation for U.S. federal income tax purposes. Under this election, the Company’s stockholders, rather than the Company, are subject to federal income taxes on their respective share of the Company’s taxable income. The Company elected similar treatment for California franchise tax purposes which, in addition, requires a state income tax at the corporate level of 1.5%. The Company was also subject to state income taxes in various other states in which it does business.

In assessing the realizability of the net deferred tax assets, management considers whether it is more likely than not that some or all of the deferred tax assets will not be realized. The ultimate realization of deferred tax assets depends upon either the generation of future taxable income during the periods in which those temporary differences become deductible or the carryback of losses to recover income taxes previously paid during the carryback period. As of December 31, 2005, the Company had provided a full valuation allowance to reduce net deferred tax assets.

The Company has a revolving line of credit with a bank at December 31, 2005 of $2,000,000. Borrowings under the line of credit bear interest at a rate equal to the bank’s prime rate minus 0.25% or the bank’s LIBOR plus 2.25% (6.75% at December 31, 2005). Any borrowings made under the line are secured by substantially all the assets of the Company and are guaranteed by certain stockholders of the Company. No amounts were outstanding under the line of credit at December 31, 2005. The line of credit expired in April 2006 and was amended to further extend the line of credit to October 2006.

At December 31, 2004 the Company had a $1,500,000 secured line of credit with a bank, which expired in January 2005. Advances under the line of credit bore interest at a rate equal to the bank’s revolving prime rate plus 1.5%. Available advances under the line were based upon a formula of eligible accounts receivable (borrowing base). Any borrowings made under the line were secured by substantially all the assets of the Company and were guaranteed by certain stockholders of the Company. At December 31, 2004, outstanding borrowings under the line of credit were $98,000, and the eligible borrowing base available was $1,231,000.

On January 14, 2004, the Company obtained a $1,000,000 term note from a bank, which expires on February 1, 2007. The term note required monthly principal and interest payments and bears interest at a rate equal to the bank’s prime rate plus 1.5%. Proceeds from the term note were used to pay off a related-party note of $200,000 (see Note 6) and pay down the secured line of credit by $800,000. At December 31, 2004, there was $695,000 of unpaid principal on the term note. This note was replaced with the secured line of credit described above.

The Company incurred interest expense of approximately $72,000, $112,000, and $81,000 during the years ended December 31, 2003, 2004 and 2005, respectively.

Covenants in connection with the line of credit impose restrictions and requirements related to, among other things, maintenance of certain financial ratios, limitations on outside indebtedness, and capital expenditures. As of December 31, 2005 and June 30, 2006 the Company was in violation of certain financial covenants (see Note 15).

The Company had an irrevocable standby letter-of-credit agreement for $75,000 which expired on August 31, 2005. This letter of credit provided security for the Company’s former corporate facility lease.

During fiscal years ended December 31, 2003 and 2004, respectively, the Company had a $200,000 note payable owed to one of the Company’s stockholders. The borrowings were unsecured, bore interest at a rate equal to 5% per annum on the unpaid principal and were due on December 31, 2004. Interest expense associated with the note was approximately $8,500 for the year ended December 31, 2003. During January 2004 the Company repaid the note owed to the stockholder.

Certain stockholders of the Company guarantee all borrowings under the revolving line of credit and secured line of credit (see Note 5). Additionally, certain stockholders of the Company guarantee substantially all of the obligations (see Note 5) due under the capital leases and operating leases (Note 7).

The Company leases certain of its operating facilities under noncancelable operating leases extending through 2013. The Company also leases certain equipment under capital leases extending through 2009. The Company also subleases certain of its facilities under non-cancellable operating leases. The present value of the remaining future minimum lease payments is recorded as capital leases in the consolidated balance sheet. The following is a schedule of future minimum lease payments under capital leases, operating leases and future noncancellable sublease income:

Rent expense related to operating leases for 2003, 2004 and 2005 was approximately $1,264,000, $1,689,000 and $1,592,000 respectively. Sublease rental income for the years ended December 31, 2003, 2004 and 2005 was $11,000, $141,000, and $126,000, respectively. Substantially all of the capital leases and one operating lease are guaranteed by certain stockholders of the Company

During 2006, the Company entered into additional operating leases at its Pasadena and UK locations extending through the year 2015.

During 2003, the Company entered into new facility operating leases. In connection with these leases, the Company received $552,000 of incentives in the form of leasehold improvements, which were paid by the lessor. The Company capitalized these incentives as leasehold improvements and deferred lease incentives, and is amortizing them over the term of the lease. In 2004 and 2005, amortization expense for these leasehold improvements was approximately $55,000 and rent expense was correspondingly reduced by approximately $55,000 as a result of the amortization of the deferred lease incentive.

In 2004, the Company’s Board of Directors and stockholders approved the 2004 Equity Incentive Plan (the “Plan”). A total of 2,062,000 shares of common stock was initially authorized and reserved for issuance under the Plan in the form of incentive and non-qualified stock options. The Plan was subsequently amended in 2005 to increase to 3,977,000 the number of shares available for issuance. Employees, officers and directors are eligible under the Plan, which is administered by the Company’s Board of Directors, who determines the terms and conditions of each grant. The terms of the options granted under the Plan are determined at the time of grant, and generally vest 25% annually over a four-year period and typically must be exercised within 10 years from the date of grant. The options prices are determined by the Company’s Board of Directors.

The following table summarizes information about stock options outstanding at June 30, 2006:

As of December 31, 2005, the number of options exercisable was 1,016,000 and the weighted average exercise price of those options was $4.54. There were no shares exercisable at December 31, 2004. During the six month period ended June 30, 2006, 170,000 options with an aggregate intrinsic value of $526,000 was exercised for total proceeds of $772,000.

A total of 1,679,000 options remain available for grant under the Company’s Plan at June 30, 2006. During the twelve months period ended June 30, 2006 the Company granted stock options with exercise prices as follows:

During the year ended December 31, 2005, the Company used the minimum-value method afforded by SFAS 123 for disclosure purposes. Accordingly, fair value information for options granted in this period is not available.

The Company has a 401(k) plan that allows all full-time eligible employees to contribute up to 15% of their annual compensation, subject to certain limitations. After one year of service, the Company will match 50% of the first 6% for each employee’s contribution, and may, at its discretion, make additional contributions regardless of profitability. The Company’s contribution related expense was $91,000, $167,000 and $267,000 in 2003, 2004 and 2005, respectively.

In April 2005, the Company’s Board of Directors and stockholders approved the Executive Retention and Severance Plan (“ERS”) to promote the interests of the Company and its stockholders by attracting and retaining executive personnel and other key employees of the Company. The ERS is designed to provide certain executive personnel with specified compensation and benefits in the event of a change in control, as defined in the ERS, or termination of employment under certain circumstances. At December 31, 2005 total severance obligations in connection with these employment contracts amounted to $1,740,000.

The Company has a profit sharing plan for its employees whereby eligible employees may receive a discretionary amount of the Company’s operating profits as defined. For the years ended December 31, 2003, 2004 and 2005, the amount paid or accrued by the Company to its employees was $262,000, $321,000 and $1,189,000, respectively.

Prior to January 1, 2006, the Company accounted for the stock options granted under the Plan by applying the intrinsic value-based method of accounting prescribed by Accounting Principles Board Opinion No. 25 (“APB 25”), “Accounting for Stock Issued to Employees”. Under this method, compensation expense is generally recorded over the vesting period, only if the fair value of the underlying stock exceeded the exercise price on the grant date. The Company adopted the disclosure-only requirements of SFAS No. 123 (“SFAS 123”) “Accounting for Stock-Based Compensation,” and SFAS No. 148 (“SFAS 148”), “Accounting for Stock-Based Compensation—Transition and Disclosure—an Amendment of FASB Statement No. 123.” These statements established accounting and disclosure requirements using a fair value-based method of accounting for share-based employee compensation plans. As allowed by SFAS 123 and SFAS 148, the Company elected to continue to apply the intrinsic value-based method described above. Accordingly, no share-based compensation for stock options is recorded in the accompanying financial statements prior to January 1, 2006, as the fair-value of the underlying stock did not exceed the exercise price of the options at the date of grant.

Effective January 1, 2006, the Company adopted SFAS No. 123R (“SFAS 123R”) “Share-Based Payment.” Prior to the adoption of SFAS 123R, the Company used the minimum-value method afforded by SFAS 123 for disclosure purposes; therefore, as prescribed by SFAS 123R, the Company adopted SFAS 123R using the prospective transition method. Accordingly, prior period amounts have not been restated. Under this transition method, compensation cost in 2006 includes the portion related to options vesting in the period for (1) all share-based payments granted prior to, but not vested as of January 1, 2006, based on the grant date intrinsic value of the option estimated in accordance with the provisions of APB 25 and (2) all share-based payments granted subsequent to January 1, 2006, based on the grant date fair value estimated in accordance with the provisions of SFAS 123R. However, as described above, no share-based compensation was recorded related to options granted prior to January 1, 2006, as the fair-value of the underlying stock did not exceed the exercise price of the options at the date of grant.

The fair values of each award granted under the Plan during the three months ended March 31, 2006 and June 30, 2006 were estimated at the date of grant using the Black-Scholes option pricing model and the following weighted average assumptions:

In March 2005, the Securities and Exchange Commission (“SEC”) issued Staff Accounting Bulletin Topic No. 107 (“SAB 107”) which provides guidance on the implementation of SFAS 123R. The Company applied the principles of SAB 107 in conjunction with its adoption of SFAS 123R. The volatility of the Company’s common stock is estimated at the date of grant based on the equally weighted-average of the implied volatility of publicly traded 30-day to 270-day options on the common stock of a select peer group of similar companies (“Similar Companies”) and the historical volatility of the common stock of Similar Companies, consistent with the

requirements of SFAS 123R and SAB 107. The risk-free interest rate that was used in the Black-Scholes option valuation model is based on the implied yield in effect at the time of each option grant, based on U.S. Treasury zero-coupon issues with equivalent remaining terms. Management uses an expected dividend yield of zero in the Black-Scholes option valuation model, as it has no intention to pay any cash dividends on its common stock in the foreseeable future. SFAS 123R requires management to estimate forfeitures at the time of grant and revise those estimates in subsequent periods if actual forfeitures differ from those estimates. Management uses historical data to estimate pre-vesting option forfeitures and records share-based compensation expense only for those awards that are expected to vest. The Company amortizes share-based compensation on a straight-line basis. All options are amortized over the requisite service period of the awards, which is generally the vesting period. The expected term of stock option awards granted was calculated using the “simplified method” as defined by SAB 107 as the Company lacks historical data and is unable to make reasonable expectations regarding the future. The weighted average estimated grant date fair value for options granted under the Company’s stock option plan during the six months ended June 30, 2006 was $5.14 per option.

As of June 30, 2006, there was $2,270,000 of total unrecognized compensation cost related to nonvested share-based compensation that is expected to be recognized over a weighted-average period of 3.75 years.

In July 2001, the Company granted restricted common shares to certain key employees. Shares were awarded subject to certain restrictions on transferability and risk of forfeiture. The forfeiture provisions in the awards expired annually over a period not to exceed three years ending June 2004. As of December 31, 2004, no share was subject to forfeiture provisions and restrictions on transferability. Stock-based compensation recorded in the statement of operations was $201,000 and $108,000 for the years ended December 31, 2003 and 2004, respectively.

In connection with hiring an executive officer, the Company entered into a stock purchase agreement (“Agreement”) on September 6, 2003 with a family member of such officer (“Investor”) pursuant to which the Company sold the Investor 412,390 shares of common stock and a warrant for an aggregate purchase price of $2,250,000. There were no significant costs incurred in connection with the sale.

The term of the warrant is 39 months and may be exercised by the Investor on or after July 1, 2006. The number of shares underlying the Warrant was subject to adjustment based upon the Company’s 2005 revenues and resulted in 206,200 shares of common stock available for purchase at a price of $0.001 per share.

In early January 2006, the Federal Trade Commission (“FTC”) commenced an inquiry into a network security breach at the Company. The Company has fully cooperated with the FTC’s inquiry. In addition, several customers who were notified of the security breach have sought compensation, which in each case has been satisfied by payment of amounts that are not material to the Company, and one customer has commenced litigation. The Company does not expect a material impact as a result of the litigation. In connection with this security breach, we have paid approximately $11,500 in fines to credit card processing companies through June 30, 2006. However, we may still face additional legal and administrative action with respect to the security breach. As of December 31, 2005, the Company has accrued approximately $500,000 for costs associated with the security breach.

The Company has agreed to indemnify its directors and executive officers for costs associated with any fees, expenses, judgments, fines and settlement amounts incurred by them in any action or proceeding to which any of them is, or is threatened to be, made a party by reason of his or her services as the Company’s director or officer.

During the normal course of business, the Company may be subject to litigation involving various business matters. Management believes that an adverse outcome of any such known matters would not have a material impact on the Company.

The Company has adopted SFAS No. 131, “Disclosures about Segments of an Enterprise and Related Information.” This standard requires segmentation based on the Company’s internal organization and reporting of revenue and other performance measures. The Company’s segments are designed to allocate resources internally and provide a framework to determine management responsibility. Operating segments are defined as components of an enterprise about which discrete financial information is available that is evaluated regularly by the chief operating decision maker, or decision making group, in deciding how to allocate resources and in assessing performance. Our chief operating decision maker is our Chief Executive Officer. The Company has four operating segments. The types of products and services provided by each segment are summarized below:

We refer to the revenue generated by our professional services and training segments, collectively, as services revenue. We refer to the revenue generated by our training segment as training revenue. We refer to the revenue generated by our maintenance segment as maintenance revenue.

Currently, the Company does not separately allocate operating expenses to these segments, nor does it allocate specific assets to these segments. Therefore, the segment information reported includes only revenues, cost of revenues and gross profit. The following tables present the operations by each operating segment:

Revenue, classified by the major geographic areas in which the Company operates, is as follows:

At December 31, 2004 and 2005, the Company’s property and equipment, net of accumulated depreciation and amortization in the United States was approximately $2,436,000 and $2,720,000, respectively. At December 31, 2004 and 2005, the Company’s property and equipment, net of accumulated depreciation and amortization in foreign countries was approximately $114,000 and $119,000, respectively.

Subsequent to the issuance of the Company’s 2004 consolidated financial statements, the Company’s management determined that it had not properly applied certain accounting guidance contained in SOP 97-2 and SOP 98-9 for its EFE software solutions revenue which began in 1997. Specifically, the Company had improperly applied paragraph 59 of SOP 97-2 for its EFE product revenues and accrued for estimated costs of providing support, instead of deferring related revenue. During that time, the Company did not have VSOE for its post-contract customer support. As a result the Company determined that it had incorrectly recognized EFE license revenue upon delivery instead of ratably amortizing the entire arrangement fee over the longer of the contractual or implied support period.

The Company’s management also determined that it had not properly applied paragraph 10 of SOP 97-2 for its EnCase^® Enterprise (EEE) software solutions revenue, which began in 2002. During that time, the Company did not have VSOE for its post-contract support. VSOE was established in 2003. As a result the Company determined that it had incorrectly recognized EEE license revenue by allocating fees to multiple elements, which then provided for the recognition of revenue upon delivery and deferral of revenue on undelivered elements, instead of ratably amortizing the entire arrangement fee for all elements of the EEE software solutions over the contractual support period.

In addition, during 2004, the Company incorrectly applied the provisions of SFAS No. 86. Specifically, the Company capitalized software development costs prior to reaching technological feasibility, as defined.

The Company also determined that it had not properly record expenses in the year incurred and it did not properly recognize certain other assets and accounts payable.

The Company has restated the accompanying consolidated financial statements as of December 31, 2004 and for each of the two years in the period ended December 31, 2004 to correct the timing of the recognition of such revenues, the recognition of capitalized software development costs, and other expenses. The net effects of the restatements on previously reported accumulated deficit as of January 1, 2003 and net income (loss) for 2003 and 2004 by the nature of the adjustment are as follows:

In connection with the Company’s anticipated filing of its initial public offering, expenses as originally reported, have been reclassified with no net impact on the 2003 and 2004 reported net income, stockholders’ deficit, and cash flows, to be consistent with the classifications adopted in 2005. These reclassifications allocated the cost of occupancy and administrative support from general and administrative expense to other expense categories to be consistent with their presentation in 2005 and 2006.

The unaudited proforma balance sheet has been presented to give proforma effect to the distribution, which will be made from the proceeds of this offering, of previously undistributed income taxed or taxable to the company’s stockholders (approximately $1.6 million as of June 30, 2006) upon termination of the S Corporation election as if it occurred June 30, 2006.

The pro forma unaudited income tax adjustments presented represent taxes which would have been reported had the Company been subject to Federal and State income taxes as a C Corporation. The pro forma provision for income taxes differs from the statutory income tax rate due to the following:

The pro forma benefit for deferred income taxes reflects temporary differences in the recognition of revenue and expenses for tax and financial reporting purposes as follows:

The Company will terminate the S Corporation election in connection with the closing of the initial public offering of stock, and expects to recognize deferred assets and liabilities representing the cumulative temporary differences as of the termination date.

On May 2, 2006, the Company’s founding stockholders contributed 2,062,000 common shares to the Company. The contribution was made as a result of a commitment by the founding stockholders, upon establishment of the 2004 Equity Incentive Plan, to fund the common shares underlying the initial 2,062,000 option grants. Upon receipt of the contribution, the Company retired the common shares. The contribution and related retirement is reflected as Donated Capital, retired in the Consolidated Statement of Stockholders’ Equity.

On May 3, 2006, the Company’s Board of Directors approved an increase in the available options for grant under the Plan to increase an additional 1,127,000 shares on May 3, 2006, 828,000 shares on January 1, 2007, 828,000 shares on January 1, 2008 and 828,000 shares on January 1, 2009.

On July 1, 2006, the warrant (Note 10) for 206,200 shares of common stock was exercised. The related proceeds were not material.

On September 5, 2006, the Company increased its revolving line of credit to $3 million and the line of credit expires in October 2007.

In the opinion of management, the following unaudited quarterly data has been prepared on the same basis as the audited financial statements and includes all adjustments, consisting of normal recurring adjustments, necessary for a fair presentation of the results of operations for the periods presented.

The following table shows the expenses to be incurred in connection with the offering described in this registration statement, all of which will be paid by the registrant. All amounts are estimates, other than the SEC registration fee, the NASD filing fee and the NASDAQ listing fee.

Section 145 of the Delaware General Corporation Law permits indemnification of officers, directors, and other corporate agents under certain circumstances and subject to certain limitations. The registrant’s certificate of incorporation, as amended, and the registrant’s bylaws, as amended, will provide that the registrant shall indemnify its directors, officers, employees and agents to the full extent permitted by the Delaware General Corporation Law, including circumstances in which indemnification is otherwise discretionary under Delaware law. In addition, the registrant will enter into separate indemnification agreements under Delaware law with its directors and executive officers which will require the registrant, among other things, to indemnify them against certain liabilities which may arise by reason of their status or service (other than liabilities arising from acts or omissions not in good faith or from willful misconduct).

These indemnification provisions and the indemnification agreements to be entered into between the registrant and its executive officers and directors may be sufficiently broad to permit indemnification of the registrant’s executive officers and directors for liabilities, including reimbursement of expenses incurred, arising under the Securities Act.

The underwriting agreement to be filed as Exhibit 1.1 to this Registration Statement provides for indemnification by the underwriters of the registrant and its executive officers and directors for certain liabilities, including liabilities arising under the Securities Act, or otherwise.

Since June 30, 2003, the registrant has sold the following securities without registration under the Securities Act of 1933:

Trust. On July 1, 2006, the Healey 2003 Family Trust exercised the warrant to purchase 206,200 shares of common stock at an exercise price of $0.001 per share. Timothy Leehealey, our Executive Vice President of Corporate Development and Marketing, is Matthew Healey’s son and one of the beneficiaries of the Healey 2003 Family Trust.

In April 2005, we granted options to a director and employees to purchase an aggregate of 606,593 shares of common stock under our 2004 Equity Incentive Plan, of which 117,824 of the options have been exercised at a price of $4.54 per share. Options to purchase 169,005 shares of common stock were subsequently cancelled. These options were granted in transactions exempt from the registration requirements of the Securities Act in reliance on Section (4)(2) of the Securities Act.

From February 2004 through July 2006, we granted stock options to our employees and directors under our 2004 Equity Incentive Plan pursuant to which the optionees may purchase up to an aggregate of 3,467,424 shares of our common stock at exercise prices ranging from $4.54 to $10.75 per share. Of the options we granted during this period, options to purchase a total of 255,660 shares of our common stock have been canceled, and options to purchase a total of 14,325 shares of common stock have been exercised, for an aggregate cash consideration of $78,809. The sale and issuance of these securities were exempt from registration under Rule 701 under the Securities Act.

The following schedule required by Item 16(b) is contained on page II-5 of this Registration Statement:

Schedule II—Valuation and Qualifying Accounts for the three years ended December 31, 2005.

Pursuant to the requirements of the Securities Act of 1933, as amended, the registrant has duly caused this registration statement to be signed on its behalf by the undersigned, thereunto duly authorized, in Pasadena, state of California, on September 15, 2006.


GUIDANCE SOFTWARE, INC.

By:		/S/ JOHN COLBERT
		Name: John Colbert Title: Chief Executive Officer and Director

KNOW ALL MEN BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints John P. Colbert, Frank J. Sansone and Victor T. Limongelli, his/her true and lawful attorneys-in-fact and agents, with full power of substitution and resubstitution, for him/her and in his/her name, place and stead, in any and all capacities, to sign any or all amendments (including post-effective amendments) to this registration statement (and any registration statement filed pursuant to Rule 462 under the Securities Act of 1933, as amended, for the offering which this registration statement relates) and to file the same, with all exhibits thereto and other documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-fact and agents and each of them, full power and authority to do and perform each and every act and thing requisite and necessary to be done in and about the premises, as fully to all intents and purposes as he/she might or could do in person, hereby ratifying and confirming all that said attorneys-in-fact and agents or any of them, or their or his/her substitute or substitutes, may lawfully do or cause to be done by virtue hereof.

Pursuant to the requirements of the Securities Act, this Registration Statement on Form S-1 has been signed by the following persons in the capacities indicated on September 15, 2006.


California	7372	95-4661210
(State of Incorporation)	(Primary Standard Industrial Classification Code Number)	(I.R.S. Employer Identification No.)


	Price to Public	Underwriting Discounts and Commissions	Proceeds to Guidance Software	Proceeds to Selling Stockholders
Per Share	$	$	$	$
Total	$	$	$	$


MORGAN STANLEY		LEHMAN BROTHERS
WACHOVIA SECURITIES		A.G. EDWARDS


	Year Ended December 31,								Six Months Ended June 30,
	2003			2004			2005		2005		2006
									(unaudited)
	(in thousands, except per share data)
Consolidated Statement of Operations Data:
Total revenues	$	17,701		$	27,604		$	39,505	$	16,825	$	24,570
Gross profit		10,990			17,686			27,784		11,694		17,591
Operating expenses:
Selling and marketing		6,269			10,693			16,186		7,075		12,383
Research and development		2,080			3,669			4,902		1,820		3,348
General and administrative		4,272			4,143			5,190		2,398		3,580

Total operating expenses		12,621			18,505			26,278		11,293		19,311

Operating (loss) income	$	(1,631	)	$	(819	)	$	1,506	$	401	$	(1,720	)

Net (loss) income	$	(1,691	)	$	(792	)	$	1,616	$	430	$	(1,656	)

Net (loss) income per share:
Basic	$	(0.10	)	$	(0.04	)	$	0.08	$	0.02	$	(0.08	)
Diluted	$	(0.10	)	$	(0.04	)	$	0.08	$	0.02	$	(0.08	)
Weighted average number of shares used in per share calculations:
Basic		17,327			19,431			20,412		20,412		19,903
Diluted		17,327			19,431			21,023		20,975		19,903

Pro forma net income data(1):
(Loss) income before taxes, as reported, unaudited	$	(1,690	)	$	(782	)	$	1,629	$	441	$	(1,634	)
Pro forma provision (benefit) for income taxes, unaudited		1			10			343		89		(711	)

Pro forma net (loss) income, unaudited	$	(1,691	)	$	(792	)	$	1,286	$	352	$	(923	)

Pro forma net (loss) income per share:
Basic, unaudited							$				$
Diluted, unaudited							$				$
Pro forma weighted average number of shares used in pro forma per share calculations(2):
Basic, unaudited
Diluted, unaudited


	As of June 30, 2006
	Actual			Pro Forma(3)	Pro Forma As Adjusted(3)
	(unaudited)
	(in thousands)
Consolidated Balance Sheet Data:
Cash and cash equivalents	$	4,038		$	$
Total assets		19,987
Capital lease obligation		896
Deferred revenue		15,527
Stockholders’ deficit		(4,189	)


		Page
Principal and Selling Stockholders		77
Certain Relationships and Related Party Transactions		79
Description of Capital Stock		81
Shares Eligible for Future Sale		84
Material United States Federal Income Tax Consequences for Non-United States Holders		86
Underwriters		89
Legal Matters		92
Experts		92
Changes in Independent Registered Public Accounting Firm		92
Where You Can Find More Information		93
Index to Consolidated Financial Statements		F-1


	As of June 30, 2006
	Actual			Pro Forma	Pro Forma As Adjusted
	(unaudited)
	(in thousands, except share amounts)
Cash and cash equivalents	$	4,038		$	$

Stockholders’ deficit
Preferred stock, $0.001 par value: no shares authorized, issued or outstanding actual; and 10,000,000 shares authorized, no shares issued or outstanding, pro forma as adjusted		—
Common stock, $0.001 par value; 100,000,000 shares authorized; 18,520,114 shares issued and outstanding, actual; 100,000,000 shares authorized; shares issued and outstanding, pro forma; 100,000,000 shares authorized; shares issued and outstanding, pro forma as adjusted	$	18		$	$
Additional paid-in capital		4,026
Accumulated deficit		(8,233	)

Total stockholders’ deficit	$	(4,189	)	$	$


Assumed initial public offering price per share		$
Pro forma net tangible book value as of June 30, 2006	$
Increase per share attributable to new investors

Pro forma as adjusted net tangible book value per share after this offering

Dilution per share to new investors		$


	Shares Purchased			Total Consideration			Average Price per Share
	Number	Percent		Amount	Percent		Average Price per Share
Existing stockholders		%		$	%		$
New investors

Total		100.0	%	$	100.0	%


	Year Ended December 31,															Six Months Ended June 30,
	2001			2002			2003			2004			2005			2005			2006
	(unaudited)															(unaudited)
	(in thousands, except per share data)
Consolidated Statement of Operations Data:
Revenues:
Product revenue	$	2,690		$	6,059		$	9,752		$	15,812		$	23,138		$	9,153		$	13,156
Services and maintenance revenue		2,911			4,475			7,949			11,792			16,367			7,672			11,414

Total revenues		5,601			10,534			17,701			27,604			39,505			16,825			24,570

Cost of revenues:
Cost of product revenue(1)		*			1,093			1,784			1,725			2,216			994			1,120
Cost of services and maintenance revenues(1)		*			3,149			4,927			8,193			9,505			4,137			5,859

Total cost of revenues		*			4,242			6,711			9,918			11,721			5,131			6,979

Gross profit		*			6,292			10,990			17,686			27,784			11,694			17,591

Operating expenses:
Selling and marketing(1)		*			3,020			6,269			10,693			16,186			7,075			12,383
Research and development(1)		*			1,312			2,080			3,669			4,902			1,820			3,348
General and administrative(1)		*			2,811			4,272			4,143			5,190			2,398			3,580

Total operating expenses		7,160			7,143			12,621			18,505			26,278			11,293			19,311

Operating (loss) income		(1,559	)		(851	)		(1,631	)		(819	)		1,506			401			(1,720	)

Other income and (expense):
Interest income		23			3			1			3			54			14			38
Interest expense		(7	)		(20	)		(72	)		(112	)		(81	)		(37	)		(21	)
Other income (expense), net		—			9			12			146			150			63			69

(Loss) income before income taxes		(1,543	)		(859	)		(1,690	)		(782	)		1,629			441			(1,634	)
Income tax provision		—			1			1			10			13			11			22

Net (loss) income	$	(1,543	)	$	(860	)	$	(1,691	)	$	(792	)	$	1,616		$	430		$	(1,656	)

Net (loss) income per share:
Basic	$	(0.11	)	$	(0.06	)	$	(0.10	)	$	(0.04	)	$	0.08		$	0.02		$	(0.08	)
Diluted	$	(0.11	)	$	(0.06	)	$	(0.10	)	$	(0.04	)	$	0.08		$	0.02		$	(0.08	)
Weighted average number of shares used in per share calculation(2):
Basic		13,842			15,419			17,327			19,431			20,412			20,412			19,903
Diluted		13,842			15,419			17,327			19,431			21,023			20,975			19,903


	As of December 31,															As of June 30, 2006
	2001			2002			2003			2004			2005			As of June 30, 2006
	(unaudited)															(unaudited)
	(in thousands)
Balance Sheet Data:
Cash and cash equivalents	$	519		$	365		$	2,735		$	2,303		$	7,556		$	4,038
Total assets		1,917			3,050			8,502			11,993			21,526			19,987
Notes payable and capital leases		145			645			1,520			1,445			733			896
Deferred revenue		4,063			4,455			6,619			9,810			16,319			15,527
Total stockholders’ deficit		(2,848	)		(3,507	)		(2,747	)		(3,431	)		(1,815	)		(4,189	)


	Year ended December 31, 2002						January 1, 2003			Year ended December 31,
	Year ended December 31, 2002						January 1, 2003			2003						2004
	Net loss			Basic and diluted loss per share			Accumulated deficit			Net income (loss)			Basic and diluted loss per share			Net loss			Basic and diluted loss per share
	(in thousands except per share data)
As previously reported	$	(1,609	)	$	(0.10	)	$	(1,006	)	$	140		$	0.01		$	(253	)	$	(0.01	)

Adjustments:
EnCase^® Forensic solutions		1,062			0.07			(2,680	)		(1,991	)		(0.11	)		(216	)		(0.01	)
EnCase^® Enterprise solutions		(145	)		(0.01	)		(145	)		145			0.01			—			—
Software development costs		—			—			—			—			—			(386	)		(0.02	)
Accrued expenses		(168	)		(0.01	)		(169	)		15			—			63			—

		749			0.05			(2,994	)		(1,831	)		(0.10	)		(539	)		(0.03	)

As restated	$	(860	)	$	(0.05	)	$	(4,000	)	$	(1,691	)	$	(0.09	)	$	(792	)	$	(0.04	)


	Year Ended December 31,						Six months ended June 30,
	2003		2004		2005		2005		2006
							(unaudited)
Statement of Operations Data:
Revenues:
Product revenue	55.1	%	57.3	%	58.6	%	54.4	%	53.5	%
Services and maintenance revenue	44.9	%	42.7	%	41.4	%	45.6	%	46.5	%

Total revenues	100.0	%	100.0	%	100.0	%	100.0	%	100.0	%

Cost of revenues:
Cost of product revenue	10.1	%	6.2	%	5.6	%	5.9	%	4.6	%
Cost of services and maintenance revenue	27.8	%	29.7	%	24.1	%	24.6	%	23.8	%

Total cost of revenues	37.9	%	35.9	%	29.7	%	30.5	%	28.4	%

Gross profit	62.1	%	64.1	%	70.3	%	69.5	%	71.6	%

Operating expenses:
Selling and marketing	35.4	%	38.7	%	41.0	%	42.1	%	50.4	%
Research and development	11.8	%	13.3	%	12.4	%	10.8	%	13.6	%
General and administrative	24.1	%	15.0	%	13.1	%	14.3	%	14.6	%

Total operating expenses	71.3	%	67.0	%	66.5	%	67.1	%	78.6	%

Operating (loss) income	(9.2	)%	(3.0	)%	3.8	%	2.4	%	(7.0	)%


	Three Months Ended
	Mar. 31, 2004			June 30, 2004			Sept. 30, 2004			Dec. 31, 2004		Mar. 31, 2005		June 30, 2005		Sept. 30, 2005		Dec. 31, 2005		Mar. 31, 2006			June 30, 2006
	(unaudited)
	(in thousands)
Statement of Operations Data
Revenue:
Product revenue	$	2,649		$	3,464		$	4,312		$	5,387	$	4,121	$	5,032	$	6,534	$	7,451	$	6,203		$	6,953
Services and maintenance revenue		2,388			3,081			3,235			3,088		3,721		3,951		4,039		4,656		4,968			6,446

Total revenues		5,037			6,545			7,547			8,475		7,842		8,983		10,573		12,107		11,171			13,399

Cost of revenues:
Cost of product revenue		347			475			442			461		454		540		589		633		492			628
Cost of services and maintenance revenue		1,787			2,193			2,147			2,066		1,960		2,177		2,375		2,993		2,689			3,170

Total cost of revenues		2,134			2,668			2,589			2,527		2,414		2,717		2,964		3,626		3,181			3,798

Gross profit		2,903			3,877			4,958			5,948		5,428		6,266		7,609		8,481		7,990			9,601

Operating expenses:
Selling and marketing		2,275			2,750			2,838			2,830		3,168		3,907		3,982		5,129		5,253			7,130
Research and development		765			896			1,013			995		912		908		1,548		1,534		1,526			1,822
General and administrative		890			1,069			1,139			1,045		1,033		1,365		1,086		1,706		1,756			1,824

Total operating expenses		3,930			4,715			4,990			4,870		5,113		6,180		6,616		8,369		8,535			10,776

Operating (loss) income	$	(1,027	)	$	(838	)	$	(32	)	$	1,078	$	315	$	86	$	993	$	112	$	(545	)	$	(1,175	)


	Payments Due by Period
	Total		Less Than 1 Year		1-3 Years		3-5 Years		Thereafter
	(in thousands)
Capital lease obligations	$	772	$	503	$	262	$	7	$	—
Real estate & other operating lease obligations		9,715		1,723		2,616		2,329		3,047

Total	$	10,487	$	2,226	$	2,878	$	2,336	$	3,047


Name	Age	Position
Directors and Executive Officers:
Shawn McCreight	40	Chairman of the Board and Chief Technology Officer
John Colbert	41	Chief Executive Officer and Director
Victor Limongelli	40	President
John Patzakis	38	Vice Chairman of the Board and Chief Legal Officer
Frank J. Sansone	35	Chief Financial Officer
Kathleen O’Neil	53	Director
Stephen Richards	52	Director
George Tenet	53	Director
Amit Yoran	35	Director

Key Employees:
Sheldon Feinland	44	Vice President, Worldwide Sales
Michael Gurzi	48	Vice President, Professional Services
Mark Harrington	39	General Counsel
Timothy Leehealey	32	Vice President, Corporate Development and Marketing


	Year	Annual Compensation		Long-Term Compensation Awards	All Other Compensation ($)(1)
Name and Principal Position	Year	Salary ($)	Bonus ($)	Securities Underlying Options	All Other Compensation ($)(1)
Shawn McCreight, Chairman and Chief Technology Officer	2005 2004 2003	250,000 232,287 168,365	— — —	— — —	— — —

John Colbert, Chief Executive Officer and Director	2005 2004 2003	223,958 204,327 163,076	— — —	67,647 — —	— — —

Victor Limongelli, President	2005 2004 2003	193,125 154,098 86,442	25,000 16,312 8,000	302,294 61,860 —	— — —

John Patzakis, Vice Chairman and Chief Legal Officer	2005 2004 2003	251,041 292,584 274,038	— — —	— — —	— — —

Frank Sansone, Chief Financial Officer	2005 2004 2003	165,460 130,702 115,000	25,000 — 7,500	169,005 61,000 —	— — —


	Individual Grants						Potential Realizable Value at Assumed Annual Rates of Stock Price Appreciation for Option Term
Name	Number of Securities Underlying Options Granted	Percent of Total Options Granted to Employees in Fiscal Year		Exercise Price per Share		Expiration Date	5%		10%
Shawn McCreight	—	—			—	—		—		—
John Colbert	67,647	3	%	$	4.54	4/20/2015	$	193,144	$	489,466
Victor Limongelli	302,294	15	%	$	4.54	4/20/2015	$	863,104	$	2,187,276
John Patzakis	—	—			—	—		—		—
Frank Sansone	169,005	9	%	$	4.54	4/20/2015	$	482,540	$	1,222,851


	Shares Acquired on Exercise	Value Realized	Number of Securities Underlying Unexercised Options at December 31, 2005		Value of Unexercised In-The-Money Options at December 31, 2005 (1)
Name	Shares Acquired on Exercise	Value Realized	Vested	Unvested	Vested		Unvested
Shawn McCreight	—	—	—	—		—		—
John Colbert	—	—	—	67,647		—	$	123,794
Victor Limongelli	—	—	15,465	348,689	$	28,301	$	637,918
John Patzakis	—	—	—	—		—		—
Frank Sansone	—	—	15,250	214,755	$	37,908	$	393,002


	Number of Shares Beneficially Owned Before the Offering	Number of Shares Being Sold in the Offering	Number of Shares Beneficially Owned After the Offering	Percentage Beneficially Owned
Name and Address of Beneficial Owner	Number of Shares Beneficially Owned Before the Offering	Number of Shares Being Sold in the Offering	Number of Shares Beneficially Owned After the Offering	Before the Offering		After the Offering
5% Stockholders and Selling Stockholders:
Bob Sheldon (1)	2,187,630			11.64	%
Larry Stinson (2)	689,939			3.67	%
Pasadena Educational Foundation (3)	112,670			*
Ken Naumann	93,026			*
Sandy Gyenes (4)	68,190			*
David Petty (5)	44,850			*
Patzakis Family Trust (6)	40,825			*
Sheldon Feinland (7)	36,250			*
John Ferro (8)	17,707			*
Mike Gurzi (9)	17,500			*
Rocco Fasciani (10)	13,500			*
Peter Patzakis (6)	10,206			*


Name		Number of Shares
Morgan Stanley & Co. Incorporated
Lehman Brothers Inc.
Wachovia Capital Markets, LLC
A.G. Edwards & Sons, Inc.

Total


Report of Independent Registered Public Accounting Firm – Deloitte & Touche LLP		F-2

Report of Independent Registered Public Accounting Firm – McGladrey & Pullen, LLP		F-3

Consolidated Balance Sheets		F-4

Consolidated Statements of Operations		F-5

Consolidated Statements of Stockholders’ Deficit		F-6

Consolidated Statements of Cash Flows		F-7

Notes to Consolidated Financial Statements		F-8


	As of December 31,						As of June 30, 2006			Pro Forma as of June 30, 2006
	2004			2005			As of June 30, 2006			Pro Forma as of June 30, 2006
							(unaudited)			(unaudited)
ASSETS
Current assets:
Cash and cash equivalents	$	2,303		$	7,556		$	4,038		$	2,470
Trade receivable, net of allowance for doubtful accounts of $134 and $139 as of December 31, 2004 and 2005, respectively and $248 as of June 30, 2006		6,510			10,235			9,396			9,396
Prepaid expenses, inventory and other current assets		463			710			1,053			1,053

Total current assets		9,276			18,501			14,487			12,919
Property and equipment, net		2,550			2,839			4,243			4,243
Other assets		167			162			296			296
Deferred offering costs		—			24			961			961

Total assets	$	11,993		$	21,526		$	19,987		$	18,419

LIABILITIES AND STOCKHOLDERS’ DEFICIT
Current liabilities:
Accounts payable	$	948		$	1,820		$	4,222		$	4,222
Accrued expenses		2,411			3,664			2,723			2,723
Capital leases		377			472			483			483
Notes payable		404			—			—			—
Deferred revenues		9,179			13,905			13,656			13,656

Total current liabilities		13,319			19,861			21,084			21,084

Long-term liabilities:
Rent incentives		810			805			808			808
Capital leases		276			261			413			413
Notes payable		388			—			—			—
Deferred revenues		631			2,414			1,871			1,871

Total long-term liabilities		2,105			3,480			3,092			3,092

Commitments and contingencies (see Notes 7 and 11):
Stockholders’ deficit:
Common stock, $0.001 par value; 100,000,000 shares authorized; 20,412,000, 20,412,000 and 18,520,000 shares issued and outstanding at December 31, 2004, December 31, 2005 and June 30, 2006 respectively		20			20			18			18
Additional paid-in capital		3,032			3,032			4,026			4,026
Accumulated deficit		(6,483	)		(4,867	)		(8,233	)		(9,801	)

Total stockholders’ deficit		(3,431	)		(1,815	)		(4,189	)		(5,757	)

Total liabilities and stockholders’ deficit	$	11,993		$	21,526		$	19,987		$	18,419


	Year Ended December 31,									Six Months Ended June 30,
	2003			2004			2005			2005			2006
										(Unaudited)			(Unaudited)
Revenues:
Product revenue	$	9,752		$	15,812		$	23,138		$	9,153		$	13,156
Services and maintenance revenue		7,949			11,792			16,367			7,672			11,414

Total revenues		17,701			27,604			39,505			16,825			24,570

Cost of revenues:
Cost of product revenue		1,784			1,725			2,216			994			1,120
Cost of services and maintenance revenue		4,927			8,193			9,505			4,137			5,859

Total cost of revenues		6,711			9,918			11,721			5,131			6,979

Gross profit		10,990			17,686			27,784			11,694			17,591

Operating expenses:
Selling and marketing		6,269			10,693			16,186			7,075			12,383
Research and development		2,080			3,669			4,902			1,820			3,348
General and administrative		4,272			4,143			5,190			2,398			3,580

Total operating expenses		12,621			18,505			26,278			11,293			19,311

Operating (loss) income		(1,631	)		(819	)		1,506			401			(1,720	)

Other income and (expense):
Interest income		1			3			54			14			38
Interest expense		(72	)		(112	)		(81	)		(37	)		(21	)
Other income, net		12			146			150			63			69

(Loss) income before income taxes		(1,690	)		(782	)		1,629			441			(1,634	)
Income tax provision		1			10			13			11			22

Net (loss) income	$	(1,691	)	$	(792	)	$	1,616		$	430		$	(1,656	)

Net (loss) income per share:
Basic	$	(0.10	)	$	(0.04	)	$	0.08		$	0.02		$	(0.08	)
Diluted	$	(0.10	)	$	(0.04	)	$	0.08		$	0.02		$	(0.08	)
Weighted average number of shares used in per share calculation:
Basic		17,327			19,431			20,412			20,412			19,903
Diluted		17,327			19,431			21,023			20,975			19,903

Pro forma net income (loss) data (unaudited):
Income (loss) before income taxes, as reported	$	(1,690	)	$	(782	)	$	1,629		$	441		$	(1,634	)
Pro forma provision (benefit) for income taxes		1			10			343			89			(711	)

Pro forma net income (loss)	$	(1,691	)	$	(792	)	$	1,286		$	352		$	(923	)

Pro forma net income (loss) per share (unaudited):
Basic							$						$
Diluted							$						$


	Common Stock					Additional Paid-in Capital		Deferred Stock-Based Compensation			Accumulated Deficit			Total Stockholders’ Deficit
	Shares		Amounts			Additional Paid-in Capital		Deferred Stock-Based Compensation			Accumulated Deficit			Total Stockholders’ Deficit
Balances at January 1, 2003, as originally reported	20,000		$	20		$	782	$	(309	)	$	(1,006	)	$	(513	)
Prior period adjustment for errors in application of accounting principles	—			—			—		—			(2,994	)		(2,994	)

Balances at January 1, 2003 (restated)	20,000			20			782		(309	)		(4,000	)		(3,507	)
Sale of common stock and warrant	412			—			2,250		—			—			2,250
Amortization of deferred stock-based compensation	—			—			—		201			—			201
Net loss	—			—			—		—			(1,691	)		(1,691	)

Balances at December 31, 2003	20,412			20			3,032		(108	)		(5,691	)		(2,747	)
Amortization of deferred stock-based compensation	—			—			—		108			—			108
Net loss	—			—			—		—			(792	)		(792	)

Balances at December 31, 2004	20,412			20			3,032		—			(6,483	)		(3,431	)
Net income	—			—			—		—			1,616			1,616

Balances at December 31, 2005	20,412			20			3,032		—			(4,867	)		(1,815	)
Share-based compensation (unaudited)	—			—			222		—			—			222
Exercise of stock options (unaudited)	170			—			770		—			—			770
Donated capital, retired	(2,062	)		(2	)		2		—			—			—
Stockholder distributions (unaudited)	—			—			—		—			(1,710	)		(1,710	)
Net loss (unaudited)	—			—			—		—			(1,656	)		(1,656	)

Balances at June 30, 2006 (unaudited)	18,520		$	18		$	4,026	$	—		$	(8,233	)	$	(4,189	)


		Estimated Useful Life
Leasehold improvements		Shorter of life of asset or lease term
Furniture and other equipment		5
Computer equipment		2-3
Purchased software		3


	Years Ended December 31,								Six Months Ended June 30,
	2003			2004			2005		2005		2006
									(unaudited)		(unaudited)
	(in thousands, except per share data)
Numerator:
Net (loss) income available to common stockholders	$	(1,691	)	$	(792	)	$	1,616	$	430	$	(1,656	)

Denominator:
Weighted average shares used in computation of basic net (loss) income per share		18,284			19,938			20,412		20,412		19,903
Incremental shares required for diluted earnings per share:
Common stock warrant		—			—			206		206		—
Stock options		—			—			405		357		—

Weighted average shares used in computation of diluted (loss) income per share-adjusted		17,327			19,431			21,023		20,975		19,903

Basic net (loss) income per share	$	(0.10	)	$	(0.04	)	$	0.08	$	0.02	$	(0.08	)

Diluted net (loss) income per share	$	(0.10	)	$	(0.04	)	$	0.08	$	0.02	$	(0.08	)


Years Ending December 31,	Future Minimum Capital Lease Payments			Future Minimum Operating Lease Payments		Future Non-Cancellable Sublease Income			Net Future Minimum Lease Operating Payments
	(in thousands)
2006	$	503		$	1,723	$	(126	)	$	2,100
2007		242			1,402		(54	)		1,590
2008		20			1,214		—			1,234
2009		7			1,203		—			1,210
2010		—			1,126		—			1,126
Thereafter		—			3,047		—			3,047

Total		772		$	9,715	$	(180	)	$	10,307

Less amounts representing interest (5.5% - 7.0%)		(39	)

	$	733


	Number of Options		Weighted-Average Exercise Price		Range of Exercise Price
Outstanding, December 31, 2003	—		$	—	$	—
Granted	1,567,000			4.54		4.54
Exercised	—			—		—
Canceled or forfeited	(105,000	)		4.54		4.54

Outstanding, December 31, 2004	1,462,000			4.54		4.54
Granted	1,971,000			4.84		4.54 - 6.32
Exercised	—			—		—
Canceled or forfeited	(104,000	)		4.73		4.54 - 6.32

Outstanding, December 31, 2005	3,329,000			4.71		4.54 - 6.32
Granted (unaudited)	535,000			6.57		6.37 - 7.64
Exercised (unaudited)	(170,000	)		4.54		4.54
Canceled or forfeited (unaudited)	(269,000	)		4.73		4.54 - 7.64

Outstanding, June 30, 2006 (unaudited)	3,425,000		$	5.01	$	4.54 - $7.64


	Options Outstanding						Options Exercisable
Exercise Price	Number of Options	Weighted- Average Remaining Contract Life (Years)	Weighted- Average Exercise Price		Aggregate Intrinsic Value		Number of Options	Weighted- Average Exercise Price		Aggregate Intrinsic Value
$4.54	2,483,000	8.25	$	4.54	$	7,694,000	890,000	$	4.54	$	2,759,000
$5.34	180,000	8.87		5.34		414,000	45,000		5.34		104,000
$6.17	155,000	9.15		6.17		228,000	—		—
$6.32	84,000	9.38		6.32		111,000	—		—
$6.37	449,000	9.65		6.37		569,000	—		—
$7.64	74,000	9.84		7.64			—		—

	3,425,000	8.57	$	5.01	$	9,016,000	935,000	$	4.58	$	2,863,000


Grants Made During Quarter Ended	Number of Options Granted	Weighted- Average Exercise Price		Weighted- Average Fair Value Per Share		Weighted- Average Intrinsic Value Per Share		Weighted- Average Fair Value Per Option
September 30, 2005	171,000	$	6.17	$	6.17	$	—		n/a
December 31, 2005	85,000		6.32		6.32		—		n/a
March 31, 2006	450,000		6.37		6.37		—	$	4.96
June 30, 2006	85,000		8.56		7.64		0.93		6.07


	Quarter Ended
	Mar. 31, 2006		June 30, 2006
	(unaudited)
Risk-free interest rate	4.57	%	5.00	%
Dividend yield	0.00	%	0.00	%
Expected life (years)	6.25		6.25
Volatility	71	%	72	%


	Year Ended December 31, 2003
	Product		Professional Services			Training		Maintenance		Total
	(in thousands)
Revenues	$	9,752	$	1,402		$	5,307	$	1,240	$	17,701
Cost of revenues		1,785		1,498			2,997		431		6,711

Gross profit	$	7,967	$	(96	)	$	2,310	$	809		10,990

Operating expenses:
Selling and marketing											6,269
Research and development											2,080
General and administrative											4,272

Total operating expenses											12,621

Operating loss											(1,631	)
Interest income											1
Interest expense											72
Other income, net											12

Loss before income taxes										$	(1,690	)


	Year Ended December 31, 2004
	Product		Professional Services			Training		Maintenance		Total
	(in thousands)
Revenues	$	15,812	$	3,032		$	6,116	$	2,644	$	27,604
Cost of revenues		1,725		3,962			3,636		595		9,918

Gross profit	$	14,087	$	(930	)	$	2,480	$	2,049		17,686

Operating expenses:
Selling and marketing											10,693
Research and development											3,669
General and administrative											4,143

Total operating expenses											18,505

Operating loss											(819	)
Interest income											3
Interest expense											112
Other income, net											146

Loss before income taxes										$	(782	)


	Year Ended December 31, 2005
	Product		Professional Services		Training		Maintenance		Total
	(in thousands)
Revenues	$	23,138	$	5,144	$	6,705	$	4,518	$	39,505
Cost of revenues		2,216		4,677		4,055		773		11,721

Gross profit	$	20,922	$	467	$	2,650	$	3,745		27,784

Operating expenses:
Selling and marketing										16,186
Research and development										4,902
General and administrative										5,190

Total operating expenses										26,278

Operating income										1,506
Interest income										54
Interest expense										81
Other income, net										150

Loss before income taxes									$	1,629