Exhibit 10.3

GUIDANCE SOFTWARE, INC.

AMENDED AND RESTATED

EXECUTIVE RETENTION AND SEVERANCE PLAN

SECTION 1. PURPOSE. The purpose of the Guidance Software, Inc. Amended and
Restated Executive Retention and Severance Plan (the “Plan”) is to promote the
interests of Guidance Software, Inc. (the “Company”) and its stockholders by
attracting and retaining exceptional executive personnel and other key employees
of the Company. The Board of Directors of the Company (the “Board”) recognizes
that the possibility or pending occurrence of a Change of Control could lead to
uncertainty regarding the consequences of such an event and could adversely
affect the Company’s ability to attract, retain and motivate its officers and
other key employees. The Board has therefore determined that it is in the best
interests of the Company and its stockholders to provide for the continued
dedication of its officers and key employees notwithstanding the possibility or
occurrence of a Change of Control by establishing this Plan to provide
designated officers and key employees with enhanced financial security in the
event of a Change of Control. The Plan is designed to provide its Participants
with specified compensation and benefits in the event of a Change of Control or
termination of employment under circumstances specified herein upon or following
a Change of Control. Effective as of December 19, 2008, this Plan amends and
restates in its entirety the Guidance Software, Inc. Executive Retention and
Severance Plan, dated April 20, 2005.

SECTION 2. DEFINITIONS. As used in the Plan, the following terms shall have the
meanings set forth below:

A. “Cause” means (i) Participant’s failure to render services to the Company or
its subsidiaries in accordance with Participant’s assigned duties and
responsibilities, and such failure of performance continues for a period of more
than fifteen days after notice thereof has been provided to Participant by the
Company (other than any such failure resulting from Participant’s disability);
(ii) any action or omission by Participant involving willful misconduct or gross
negligence relating to Participant’s duties and responsibilities to the Company
or its affiliates, including without limitation, disloyalty, dishonesty or
breach of fiduciary duty; (iii) Participant’s commission of (as determined by
the Company) or indictment for a crime, either in connection with the
performance of Participant’s obligations to the Company or its affiliates or
which otherwise shall adversely affect Participant’s ability to perform such
obligations or which shall adversely affect the business activities, reputation,
goodwill or image of the Company or its affiliates; (iv) Participant’s breach of
any material obligation Participant has under any written agreement with the
Company or its affiliates or which has been delegated to Participant by the
Company which, if capable of cure, is not cured within five days from receipt of
notice from the Company; or (v) any act of fraud, embezzlement, theft or
misappropriation from the Company or its affiliates by Participant.

B. “Change of Control” means a Corporate Transaction other than a merger,
consolidation or other capital reorganization in which the holders of more than
fifty percent (50%) of the shares of capital stock of the Company outstanding
immediately prior to such transaction continue to hold (either by the voting
securities remaining outstanding or by being converted into voting securities of
the surviving entity) more than fifty percent (50%) of the total voting power
represented by the voting securities of the Company, or such surviving entity,
outstanding immediately after such transaction.

--------------------------------------------------------------------------------

C. “Constructive Termination” means Participant’s voluntary termination, upon
thirty (30) days prior written notice to the Company, within sixty (60) days
after the occurrence of any of the following events without the Participant’s
prior written consent: (1) a reduction by the Company of the Participant’s base
compensation by greater than five percent (5%); (2) the Company (or, as
applicable, the successor or surviving entity) following a Change of Control
does not continue Participant’s employment in a senior position for the business
that constitutes the Company’s operations immediately prior to the Change of
Control with the same or greater authority, duties, and responsibilities as
those held by the Participant immediately prior to the Change of Control; or
(3) Participant is required to report for work in person on a regular and daily
basis at a facility or location more than thirty-five (35) miles from
Participant’s current office location.

D. “Corporate Transaction” means the Company becoming majority owned by another
corporation or entity, or a sale of all or substantially all of the Company’s
stock or assets, or a merger, consolidation or other capital reorganization of
the Company with or into another corporation.

E. “Participant” means any employee of the Company selected by the Board to be
eligible to receive benefits under the Plan (and to the extent applicable, any
heirs or legal representatives thereof).

F. “Participation Agreement” means an agreement to participate in the Plan
substantially in the form attached hereto as Exhibit A or in such other form as
the Board may approve from time to time; provided, however, that, after a
Participation Agreement has been entered into between a Participant and the
Company, it may be modified only by a supplemental written agreement executed by
both Participant and the Company.

SECTION 3. ELIGIBILITY. The Board shall designate those officers and key
employees who shall be eligible to become Participants in the Plan.

SECTION 4. CHANGE OF CONTROL. In the event of a Change of Control, the following
provisions will apply:

A. Subject to Section 4.D. below, if, during the two (2)-year period immediately
following the closing of a Change of Control, Participant incurs a “separation
from service” from the Company (within the meaning of Section 409A(a)(2)(A)(i)
of the Internal Revenue Code of 1986, as amended (the “Code”), and Treasury
Regulation Section 1.409A-l(h)) (a “Separation from Service”) by reason of a
termination of Participant’s employment by the Company without Cause, or by
Participant as the result of a Constructive Termination, then:

1. The Company shall pay Participant a lump sum, one-time payment equal to twice
Participant’s annual base salary in effect on the date of Participant’s
Separation from Service, plus an amount equal to any tax imposed on such payment
under Section 4999 of the Code (but not grossed up further with respect to any
such tax imposed on any other payment to Participant or any tax imposed on the
tax gross-up payment itself) (such aggregate amount, the “Change of Control
Payment”), payable within fifteen (15) days after the date of Participant’s
Separation from Service (with the exact payment date to be determined by the
Company in its discretion);

 

2

--------------------------------------------------------------------------------

2. For a period of twenty-four (24) months immediately following the date of
Participant’s Separation from Service (the “Continuation Period”), the Company
shall provide medical insurance, dental insurance and vision insurance
(collectively, the “Health Insurance Benefits”) to Participant at the same
premium cost to Participant and at the same coverage level as in effect
immediately preceding the date of Participant’s termination of employment. If
such Health Insurance Benefits are to be provided through third-party insurance
maintained by the Company under the Company’s benefit plans in a manner that
causes such Health Insurance Benefits to be exempt from the application of
Section 409A of the Code under Treasury Regulation Section 1 .409A- 1 (a)(5),
the Company shall pay or reimburse the Company- subsidized portion of the
insurance premiums in accordance with the Company’s normal payment practices,
provided, that if, any plan pursuant to which such Health Insurance Benefits are
provided is not, or ceases prior to the expiration of the Continuation Period to
be, exempt from the application of Section 409A of the Code under Treasury
Regulation Section l.409A- 1 (a)(5), then an amount equal to the
Company-subsidized portion of each remaining premium payment or reimbursement
shall thereafter be paid to Participant as currently taxable compensation in
substantially equal monthly installments over the remainder of the Continuation
Period.

3. For the Continuation Period, the Company shall provide life insurance and
disability insurance coverage to Participant that is reasonably similar to that
provided to Participant immediately prior to Participant’s termination of
employment, provided that such coverage shall be provided at the same premium
cost to Participant and on substantially the same terms and conditions as in
effect immediately preceding the date of Participant’s termination of
employment. To the greatest extent applicable, such coverage shall be provided
in a manner that satisfies the exemption from Section 409A of the Code under
Treasury Regulation Section l.409A-1(a)(5). To the extent that such coverage
does not satisfy such exemption, the Company shall provide such coverage by
making direct payment, in accordance with the Company’s standard payment
practices for such insurance, to the insurer of the cost of Participant’s life
insurance and disability insurance premiums applicable to such continued
coverage; provided, however, that the Company shall not be obligated to make
such direct payments to the insurer or provide such coverage unless the
Participant remits to the Company on a monthly basis an amount equal to the
Participant’s monthly premium cost for such coverage.

B. If Participant dies at any time during the three (3) month period prior to
the date on which a Change of Control occurs (the “Change of Control Date”), or
the three (3) month period after the Change of Control Date, the Company shall
make the Change of Control Payment to the estate of Participant as follows:

(i) if Participant’s death occurs prior to the Change of Control Date, such
payment shall be made within fifteen (15) days after the earlier to occur of
(i) the date which is three months after the date of Participant’s death, or
(ii) the Change of Control Date, but only if such Change of Control constitutes
a “change in control event” (within the meaning of Section 409A(a)(2)(A)(v) of
the Code, and Treasury Regulation Section 1 .409A-3(i)(5)) (with the exact
payment date to be determined by the Company in its discretion); and

 

3

--------------------------------------------------------------------------------

(ii) if Participant’s death occurs on or after the Change of Control Date, such
payment shall be made within fifteen (15) days after the date of Participant’s
death (with the exact payment date to be determined by the Company in its
discretion).

C. Subject to Section 4.D. below, if Participant incurs a Separation from
Service by reason of Participant’s resignation of his employment for any reason
during the period commencing on the date that is six (6) months after the Change
of Control Date and ending on the date that is twelve (12) months after the
Change of Control Date, the Company shall make the Change of Control Payment to
Participant within fifteen (15) days after the date of Participant’s Separation
from Service (with the exact payment date to be determined by the Company in its
discretion) (and, for the avoidance of doubt, Participant shall not also be
entitled to an additional Change in Control Payment under Section 4.A. 1 above).

B. Notwithstanding anything to the contrary in the Plan, no compensation or
benefits, including without limitation any severance payments or benefits
payable under this Section 4, shall be paid to Participant during the 6-month
period following Participant’s Separation from Service if the Company determines
that paying such amounts at the time or times indicated in the Plan would be a
prohibited distribution under Section 409A(a)(2)(B)(i) of the Code. If the
payment of any such amounts is delayed as a result of the previous sentence,
then on the first business day following the end of such 6-month period (or such
earlier date upon which such amount can be paid under Section 409A of the Code
without resulting in a prohibited distribution, including as a result of
Participant’s death), the Company shall pay Participant a lump-sum amount equal
to the cumulative amount that would have otherwise been payable to Participant
during such period.

E. The Company will inform the successor (whether direct or indirect, by
purchase, merger, consolidation or otherwise) to the Company prior to the
closing of the Change of Control of the provisions of this Section 4, and will
require such successor to assume the Plan as a condition to a closing of the
Change of Control. For purposes of the Plan, “Company” shall be deemed to mean
the Company as defined in Section 1 and any such successor, including any
surviving entity thereof, that assumes the Plan by operation of law or
otherwise.

SECTION 5. TERMINATION AND AMENDMENT OF THE PLAN. The Plan and/or any
Participation Agreement executed by a Participant may not be terminated with
respect to such Participant without the written consent of Participant. The Plan
and/or any Participation Agreement executed by a Participant may be modified,
amended or superseded with respect to such Participant only by a supplemental
written agreement between Participant and the Company.

 

4

--------------------------------------------------------------------------------

SECTION 6. AGREEMENT. By executing a Participation Agreement, Participant
acknowledges that Participant has received a copy of this Plan and has read,
understands and is familiar with the terms and provisions of this Plan. This
Plan shall constitute an agreement between the Company and Participant executing
a Participation Agreement.

SECTION 7. NO DUPLICATION OF BENEFITS. The payments and benefits provided under
this Plan are in lieu of and not in addition to any severance benefits provided
under the terms of any employment or other agreement between a Participant and
the Company, and in no event shall any Participant be entitled to any payment or
benefit under the Plan to the extent that such payment or benefit would result
in a duplication of a payment or benefit to which such Participant is entitled
under such employment or other agreement.

SECTION 8. CODE SECTION 409A.

A. To the extent applicable, the Plan shall be interpreted and applied
consistent and in accordance with Section 409A of the Code and Department of
Treasury regulations and other interpretive guidance issued thereunder.
Notwithstanding any provision of the Plan to the contrary, if the Company
determines that any compensation or benefits payable under the Plan may not be
either exempt from or compliant with Section 409A of the Code and related
Department of Treasury guidance, the Company may in its sole discretion adopt
such amendments to the Plan or adopt other policies and procedures (including
amendments, policies and procedures with retroactive effect), or take any other
actions, that the Company determines are necessary or appropriate to (i) exempt
the compensation and benefits payable under the Plan from Section 409A of the
Code and/or preserve the intended tax treatment of such compensation and
benefits, or (ii) comply with the requirements of Section 409A of the Code and
related Department of Treasury guidance; provided, however, that this paragraph
shall not create an obligation on the part of the Company to adopt any such
amendment, policy or procedure or take any such other action.

B. To the extent permitted under Section 409A of the Code, any separate payment
or benefit under the Plan or otherwise shall not be deemed “nonqualified
deferred compensation” subject to Section 409A of the Code (and Section 4.D.
above) to the extent provided in the exceptions in Treasury Regulation Section 1
.409A- 1 (b)(4), Section 1 .409A- 1 (b)(9) or any other applicable exception or
provision of Section 409A of the Code.

C. To the extent that any payments or reimbursements provided to any Participant
under the Plan are deemed to constitute compensation to which Treasury
Regulation Section l.409A-3(i)(l)(iv) would apply, such amounts shall be paid or
reimbursed to Participant reasonably promptly, but not later than December 31 of
the year following the year in which the expense was incurred. The amount of any
such payments eligible for reimbursement in one year shall not affect the
payments or expenses that are eligible for payment or reimbursement in any other
taxable year, and Participant’s right to such payments or reimbursement shall
not be subject to liquidation or exchange for any other benefit.

 

5

--------------------------------------------------------------------------------

IN WITNESS WHEREOF, the undersigned Secretary of the Company certifies that the
foregoing Plan was duly adopted by the Board on December 19, 2008.

 

/s/ Mark Harrington

Mark Harrington

 

6

--------------------------------------------------------------------------------

Exhibit A

FORM OF AGREEMENT TO PARTICIPATE IN THE

GUIDANCE SOFTWARE, INC.

AMENDED AND RESTATED EXECUTIVE RETENTION AND SEVERANCE PLAN

Agreement to Participate in the Guidance Software, Inc. Amended and Restated
Executive Retention and Severance Plan

In consideration of the benefits provided by the Guidance Software, Inc. Amended
and Restated Executive Retention and Severance Plan (the “Plan”), the
undersigned employee of Guidance Software, Inc. (the “Company”) and the Company
agree that, as of the date written below, the undersigned shall become a
Participant in the Plan and shall be fully bound by and subject to all of its
provisions. All references to a “Participant” in the Plan shall be deemed to
refer to the undersigned.

The undersigned employee acknowledges that the Plan confers significant legal
rights and may also constitute a waiver of rights under other agreements with
the Company; that the Company has encouraged the undersigned to consult with the
undersigned’s personal legal and financial advisers; and that the undersigned
has had adequate time to consult with the undersigned’s advisers before
executing this agreement.

The undersigned employee acknowledges that he or she has received a copy of the
Plan and has read, understands and is familiar with the terms and provisions of
the Plan. The undersigned employee further acknowledges that, except as
otherwise established in an employment agreement between the Company and the
undersigned, if any, the employment relationship between the undersigned and the
Company is an “at-will” relationship.

 

GUIDANCE SOFTWARE, INC.      PARTICIPANT

 

    

 

Signature      Signature [                            ]     
[                            ] Name      Name (printed)

 

    

 

Title      Date

 

     Date