##### Table of Contents

---

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549



---

FORM 10K



---

(Mark One)

|x | ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
|- | ------------------------------------------------------------------------------------

For the fiscal year ended December 31, 2006

OR



| ̈ | TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
|- | ----------------------------------------------------------------------------------------

For the transition period from                          to
                        .

Commission File Number 001-33197



---

GUIDANCE SOFTWARE, INC.

(Exact name of registrant as specified in its charter)



---



|                                                               |  |                                     
|-------------------------------------------------------------- |  | ------------------------------------
|Delaware                                                       |  | 95-4661210                          
|(State or other jurisdiction of incorporation or organization) |  | (I.R.S. Employer Identification No.)
|                                                               | 
|215 North Marengo Avenue Pasadena, California                  |  | 91101                               
|(Address of principal executive offices)                       |  | (Zip Code)                          

Registrants telephone number, including area code: (626) 229-9191

Securities registered pursuant to Section 12(b) of the Act:

None.

Securities registered pursuant to Section 12(g) of the Act:

Common Stock

(Title of class)



---

DOCUMENTS
INCORPORATED BY REFERENCE

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.    Yes ̈No  x

Indicate by check mark if the
registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.    Yes ̈No  x

Indicate by check mark whether the registrant:
(1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and
(2) has been subject to such filing requirements for the past 90 days.    Yes  x    No ̈

Indicate by check mark if disclosure of delinquent filers pursuant to
Item 405 of Regulation of S-K is not contained herein, and will not be contained, to the best of the registrants knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any
amendment to this Form 10-K. ̈

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, or a non-accelerated filer (as defined in Rule 12b-2 of the Exchange Act):

Large accelerated filer ̈Accelerated filer ̈Non-accelerated filer  x

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange
Act).    Yes ̈No  x

The aggregate market value of the voting stock held by non-affiliates of the registrant computed by reference to the price at which the common equity was
last sold on March 26, 2007, as reported on the Global Market tier of The NASDAQ Stock Market, Inc. was $104,600,832.*

As of
March 26, 2007, there were 22,167,095 shares of the registrants Common Stock outstanding.



|* | Excludes shares of Common Stock held by executive officers, directors and stockholders whose ownership exceeds 5% of the shares outstanding at March 26, 2007. This calculation
does not reflect a determination that such persons are affiliates for any other purposes.
|- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

DOCUMENTS INCORPORATED BY
REFERENCE

Portions of the registrants definitive proxy statement to be filed with the Commission pursuant to Regulation 14A in
connection with the registrants 2006 Annual Meeting of Stockholders (the Proxy Statement) or portions of the registrants 10-K/A, to be filed subsequent to the date hereof, are incorporated by reference into Part III of this
Report. Such Proxy Statement or 10-K/A will be filed with the Commission not later than 120 days after the conclusion of the registrants fiscal year ended December 31, 2006.



---



---

##### Table of Contents

GUIDANCE SOFTWARE, INC.

Form 10-K

For the Fiscal Year Ended December 31, 2006

Table of Contents



|                                                                                                        |  |     
|------------------------------------------------------------------------------------------------------- |  | ----
|                                                                                                        |  | Page
|PART I                                                                                                  |  | 1   
|                                                                                                        | 
|Item 1. Business                                                                                        |  | 1   
|Item 1A. Risk Factors                                                                                   |  | 18  
|Item 2. Properties                                                                                      |  | 32  
|Item 3. Legal Proceedings                                                                               |  | 32  
|Item 4. Submission of Matters to a Vote of Security Holders                                             |  | 33  
|                                                                                                        | 
|PART II                                                                                                 |  | 34  
|                                                                                                        | 
|Item 5. Market for Registrants Common Equity and Related Stockholder Matters                           |  | 34  
|Item 6. Selected Consolidated Financial Data                                                            |  | 36  
|Item 7. Managements Discussion and Analysis of Financial Condition and Results of Operations           |  | 37  
|Item 7A. Quantitative and Qualitative Disclosure about Market Risk                                      |  | 50  
|Item 8. Financial Statements and Supplementary Data                                                     |  | 50  
|Item 9. Changes in and Disagreements with Accountants on Accounting and Financial Disclosure            |  | 50  
|Item 9A. Controls and Procedures                                                                        |  | 51  
|                                                                                                        | 
|PART III                                                                                                |  | 53  
|                                                                                                        | 
|Item 10. Directors and Executive Officers of the Registrant                                             |  | 53  
|Item 11. Executive Compensation                                                                         |  | 53  
|Item 12. Security Ownership of Certain Beneficial Owners and Management and Related Shareholder Matters |  | 53  
|Item 13. Certain Relationships and Related Transactions                                                 |  | 53  
|Item 14. Principal Accountant Fees and Services                                                         |  | 53  
|                                                                                                        | 
|PART IV                                                                                                 |  | 54  
|                                                                                                        | 
|Item 15. Exhibits and Financial Statement Schedules                                                     |  | 54  
|                                                                                                        | 
|Signature                                                                                               |  | S-1 

TRADEMARKS

Guidance Software, EnScript® , EnCase® Enterprise, Snapshot, EnCase® eDiscovery Suite, EnCase® Enterprise AIRS, EnCase® Forensic, FastBloc® , CEIC®
, EnCE®  and other trademarks or
service marks of Guidance appearing in this prospectus are registered trademarks or trademarks of Guidance in the United States and in certain other jurisdictions. This prospectus also contains additional trade names, trademarks and service marks of
ours and of other companies. We do not intend our use or display of other companies trade names, trademarks or service marks to imply a relationship with, or endorsement or sponsorship of us by these other companies.



i



---

##### Table of Contents

FORWARD-LOOKING STATEMENTS AND FACTORS THAT MAY AFFECT FUTURE RESULTS

This Annual Report (including the section regarding Managements Discussion and Analysis of Financial Condition and Results of Operations) contains
forward-looking statements regarding our business, financial condition, results of operations and prospects. Words such as expects, anticipates, intends, plans, believes, seeks,
estimates and similar expressions or variations of such words are intended to identify forward-looking statements, but are not the exclusive means of identifying forward-looking statements in this Annual Report. Additionally, statements
concerning future matters such as the development of new products, sales levels, expense levels and other statements regarding matters that are not historical are forward-looking statements.

Although forward-looking statements in this Annual Report reflect the good faith judgment of our management, such statements can only be based on facts
and factors currently known by us. Consequently, forward-looking statements are inherently subject to risks and uncertainties and actual results and outcomes may differ materially from the results and outcomes discussed in or anticipated by the
forward-looking statements. Factors that could cause or contribute to such differences in results and outcomes include without limitation those discussed under the heading Risk Factors below, as well as those discussed elsewhere in this
Annual Report. Readers are urged not to place undue reliance on these forward-looking statements, which speak only as of the date of this Annual Report. We undertake no obligation to revise or update any forward-looking statements in order to
reflect any event or circumstance that may arise after the date of this Annual Report. Readers are urged to carefully review and consider the various disclosures made in this Annual Report, which attempt to advise interested parties of the risks and
factors that may affect our business, financial condition, results of operations and prospects.



ii



---

##### Table of Contents

PART I



|Item 1. | Business
|------- | --------

Overview

We develop and provide the leading software solutions for digital investigations. EnCase® Enterprise, our flagship product, enables corporations and government agencies to
search, collect, preserve and analyze, from a single location, data across the servers, desktops and laptops that comprise their entire network. Our EnCase® Forensic software, which we believe is the industry standard tool in the field of digital forensic software, is used primarily by law
enforcement and government agencies for searching, collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court proceedings. We also offer a comprehensive array of forensic investigation
and training services to help our customers manage their internal digital investigations, including eDiscovery requests, and learn how to effectively and efficiently use our software. Our EnCase® Enterprise customer base currently includes more than 100 companies in the Fortune 500,
and we have deployed our EnCase® Forensic software
to more than 1,000 government and law enforcement agencies and other customers worldwide.

We were incorporated in California in November
1997 and reincorporated in Delaware in December 2006.

Industry Background

The widespread reliance on digital business processes and the explosive growth in volume of electronic data has resulted in exposure to electronic
data-related risks and created the need to properly conduct digital investigations.

The global adoption of local area networks,
wide area networks, e-mail and the Internet has increased communications within and between organizations and has created the ability to generate, store, share and distribute massive amounts of electronic information instantaneously without regard
to physical location. While the adoption and reliance on these technologies has significantly increased productivity and lowered the cost of doing business for Global 2000 companies, government agencies and other organizations, it has also exposed
organizations to many increasing areas of risk associated with the continued proliferation of electronic data. Organizations now are increasingly faced with the need to recover and analyze vast amounts of electronic data quickly and efficiently
through processes we refer to as digital investigations. Digital investigations are conducted to address various electronic data-related needs, including:



| |  |  | searching, collecting and processing litigation-related data, or responding to discovery requests for electronic data, or eDiscovery requests, where a
company must conduct a thorough yet timely review of electronic data in order to produce forensically sound electronic documents or other digital evidence in connection with a particular civil or administrative proceeding;
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | responding to regulatory data requests, where an organization must efficiently and rapidly produce electronic documents and digital evidence in connection with a
project under regulatory review in a manner acceptable to the regulators;
| | - |  | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | addressing corporate policy violations, such as intellectual property theft, employee fraud and employee policy violations, all of which must be investigated
rapidly, described in a detailed, complete and comprehensible report of the incident and mitigated and remedied across an enterprise network as necessary, all while minimizing business interruption; and
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | responding to IT security attacks or breaches, where an organization must expeditiously and unobtrusively determine which systems or files were affected, the nature
of the attack and how to remediate the issue quickly before any further damage occurs.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Traditional investigations
into electronic data-related threats are inadequate.

Traditional digital investigations involve internal investigators or
third-party consultants manually searching through a multitude of electronic data in an attempt to discover traces or fingerprints of an electronic data-related incident. Such investigators or third-party consultants typically use
software applications, utilities or



1



---

##### Table of Contents

processes, such as taking the affected servers, desktops and laptops off-line, so that they can remove, image or copy the hard drives, manually extract the
data in question on each affected computer and save the affected files to another hard drive for processing and analysis by consultants or other third-party experts. These traditional digital investigations suffer from several distinct problems.
They:

Are costly and time-consuming. Most electronic data-related incidents that occur today involve more than one machine, and
often involve hundreds of thousands of servers, desktops and laptops operating across an enterprise including remote offices or workgroups, making the task of conducting manual investigations time-consuming, costly, and often beyond the resources of
internal IT personnel.

Require significant expertise to conduct across complex enterprise network environments. An
organizations enterprise network generally consists of multiple operating system platforms and software applications operating simultaneously across a network of servers, desktops and laptops with layers of data that need to be identified,
recovered, organized, analyzed, preserved and presented during the investigative process. In the context of a manual digital investigation, understanding the intricacies of each of the multiple operating system platforms and software applications
requires extensive training and a high level of human expertise.

May not adequately combat attempts to conceal data. An effective
digital investigation must uncover and analyze all of the data relevant to the particular issue. This is extremely difficult to achieve in the digital world because perpetrators of malicious acts are typically motivated to hide incriminating
evidence. Also, certain forms of IT security exploits, such as rootkits or keystroke loggers, embed themselves deep within the operating system and are undetectable by typical anti-virus software packages. Capturing data to facilitate the
investigation is complicated, and traditional digital investigative techniques generally fail to capture all relevant data.

Often
result in unwanted exposure of sensitive materials and disrupt business. Traditional digital investigative methods often result in physically removing the machines in question from the users and manually searching the hard drives for relevant
data, thereby informing the subject employees and co-workers of the ongoing investigative process. In addition, traditional digital investigations can result in significant business disruption by removing affected machines from their users for
extended periods of time.

Are difficult to conduct in a forensically sound manner. Digital investigations must be conducted in a
forensically sound manner in order to preserve evidence for effective use in a court proceeding. In order to produce forensically sound evidence that can withstand legal challenges, including chain of custody, storage, cross-contamination and
tampering allegations, any digital investigation must be conducted by expert personnel at all stages of the investigative process. Such personnel must be able to competently demonstrate that the chain of custody with respect to the evidence has not
been broken or compromised and that the digital evidence has been properly stored in its originally discovered state without changes or alterations. Use of software applications, utilities or processes not designed to meet this legal threshold may
damage, alter or overwrite evidence, such as critical dates and times, which may ultimately result in the evidence being refused by the court, or being substantially reduced in evidentiary value.

Establishing a comprehensive digital investigative software platform can help organizations address the inadequacies of traditional digital
investigations and cost-effectively mitigate the risk of electronic data-related threats.

In order to effectively address the
problems associated with traditional digital investigations, organizations require a comprehensive digital investigative software platform that enables them to cost-effectively conduct digital investigations at any time, quickly respond to
eDiscovery requests and take decisive action in response to internal and external IT security and data breaches. Failure to effectively implement such a platform can expose an organization to significant risk and, in the case of the regulatory and
legal environment, may subject the organization to criminal or civil financial or legal penalties, fines or adverse judgments. For example, Morgan Stanley paid a $15 million civil fine to federal regulators for failing to provide emails sought by
the regulators, UBS AG suffered an adverse judgment of approximately $29.2 million, and Phillip Morris USA was fined approximately $2.75 million for non-compliance with eDiscovery requests.



2



---

##### Table of Contents

The market for digital investigation and cyber forensic solutions is expected to grow from $600 million
in 2005 to $1.4 billion in 2009, representing a compounded annual growth rate of 24%, according to IDC. The market for eDiscovery solutions is expected to grow from $832 million in 2004 to $3.1 billion in 2008, representing a compounded annual
growth rate of approximately 40%, according to Socha-Gelbman. According to the 2006 Litigation Trends Survey by Fulbright & Jaworski L.L.P., corporations with over $1 billion in revenues responding to the survey reported that they were
involved in an average of 389 lawsuits in the United States.

We believe that recent amendments to the Federal Rules of Civil Procedure
will motivate companies regularly involved in litigation in the federal courts to implement digital investigative software. These amendments mandate that litigants must meet after commencing litigation to discuss production of electronic evidence,
specify that the general obligation of litigants to identify and preserve relevant evidence explicitly applies to electronic data in their possession, and empower litigants conducting discovery to specify the electronic format in which the other
party should produce the electronic data. This is in contrast to the previous rules, under which there was no specific obligation to meet and discuss production of electronic evidence and both the obligation to preserve and identify electronic
evidence and the format in which electronic data was to be produced during discovery were themselves the subject of frequent disputes between the parties.

Our Solution

We develop and provide the leading software solutions to conduct digital investigations. The key benefits and
advantages of our products and services include:

Our EnCase® Enterprise software is designed to conduct enterprise-class digital investigations and operate across the largest and
most complex enterprise network environments.

Our EnCase® Enterprise software is a network-enabled solution that allows corporations and government agencies to search, collect,
preserve and analyze, from a single location, data across all of the servers, desktops and laptops that comprise their network and is designed to efficiently conduct enterprise-class digital investigations. EnCase® Enterprise enables our customers to rapidly search across networks of up to
hundreds of thousands of servers, desktops or laptops. Our software also interoperates with a wide variety of computing environments that are typically found within the networks of large enterprise companies, including across 16 unique operating
systems and 21 unique file systems. Customers can add our eDiscovery Suite to EnCase® Enterprise to enable them to automate the traditionally manual eDiscovery process, or our Automated Incident Response Suite to EnCase® Enterprise to automate the response to security breaches. Each of these add-on suites is modular, offering customers
the option to deploy the entire EnCase® Enterprise
solution all at once, or incrementally as their future needs arise. In addition, our customers may continue to enhance the capabilities of our EnCase® Enterprise software by utilizing our EnScript® programming language to write or incorporate customized applications specific to their network environments or investigative needs. These
broad-ranging capabilities of our EnCase®
Enterprise software give our customers the essential foundation on which to build a sophisticated, sound and secure platform for digital investigations.

Our EnCase®
products and services provide cost-effective and efficient digital investigation solutions.

Our EnCase® products and services significantly reduce the disruption and expense entailed
in a traditional digital investigation. The sophisticated technological capabilities of our EnCase® products often permit our customers to reduce the use of multiple third-party computer forensics, managed security services and consulting companies, thereby reducing the costs and
resources required to conduct a comprehensive digital investigation. In addition, our customers are able to address issues that historically have been ignored or not timely addressed due to prohibitive cost and extensive time resources required to
fully pursue such traditional digital investigations.



3



---

##### Table of Contents

Our software enables comprehensive digital investigations by discovering concealed data.

One fundamental capability underlying our EnCase® Enterprise and EnCase® Forensic software is the ability to discover hidden or concealed data, such as rootkits. We have designed our software to run
beneath the operating system, which enables our software to access the hard drive at the sector level, which is the smallest writeable area on a hard drive. Using our EnCase® software, our customers are able to collect data from the sectors on the hard drive in
a raw format and analyze the entire accessible hard drive, including files not generally accessible to the average user. The software collects and stores this electronic data without any modifications that normally result from the traditional
approach of detection, recovery and analysis of such data.

Our products and services are designed to minimize any disruption to
business and to preserve the confidentiality of any investigation.

Our EnCase® software architecture enables customers to easily gain access and visibility into their
entire IT infrastructure, which could easily comprise hundreds of thousands of servers, desktops or laptops, and permits trained data security personnel to conduct digital investigations from a single, centralized console, all without disrupting
business operations or unnecessarily alerting employees. Our EnCase® products and services thereby enable our customers not only to minimize the disruption to their businesses resulting from the shutdown or removal of servers, desktops and laptops, but also to preserve the sensitivity
and confidentiality of any digital investigation.

EnCase® software, which is the recognized standard for digital investigations in the courtroom, preserves forensically sound
digital evidence for presentation by investigators.

We believe that EnCase® software is the most widely recognized and trusted digital investigative solution
across the Global 2000 and among federal, state, local and foreign government agencies. Since its introduction in 1998, EnCase® software has been used in thousands of criminal and civil cases, including a number of the recent highest profile criminal cases, such as the Scott
Peterson murder trial and the BTK killer case. There is established case law that affirmatively supports the admissibility of digital evidence collected via EnCase® software, as it has been cited by name or discussed in over 35 judicial decisions or opinions from federal, state and
foreign courts. From our first beta release in 1998 to our sixth generation product released in 2006, EnCase® Forensic has been designed to enable increasingly powerful forensics capabilities for our customers while placing the utmost emphasis on processes and procedures that demonstrate the
integrity of the investigative process in court. As a result, EnCase® software has become a globally recognized standard for digital investigations and trusted electronic data collection.

Our consulting, implementation and training services enhance the capabilities of our product offerings.

We offer a comprehensive array of consulting, implementation and training services to help our customers. We provide eDiscovery and computer security incident response services, conduct digital investigations on
behalf of our customers and perform systems and software maintenance and document retention audits. Many of our professional consultants are asked to testify in court as industry experts in the field of computer forensic investigations. Our training
program offerings enable our customers to learn how to maximize the capabilities of our EnCase® software, thereby permitting our customers to maintain digital investigation expertise within their organizations. In addition to the training courses, we also provide an EnCase® Certified Examiner (EnCE®) program which certifies the competency of public
and private sector employees in the best practices of digital forensic investigations and in the use of our EnCase® software products in such digital investigations.

Our EnCase® products are designed to
meet the unique digital investigative needs of federal, state, local and foreign government agencies and law enforcement personnel.

Our EnCase® Forensic software enables
federal, state, local and foreign government agencies and law enforcement personnel to conduct, on a single machine, the full array of forensic functions, including data



4



---

##### Table of Contents

capture, analysis and the documentation and reporting of digital evidence, all while preserving the legal integrity of the investigation process. Many of
these government agencies also use our EnCase®
Enterprise software to address their specific internal digital investigative concerns, including classified message leaks and cyber warfare.

Our
Strategy

Our objective is to enhance our position as a leading global provider of digital investigation solutions for large
corporations, government organizations and law enforcement agencies. The key elements of our strategy include:

Expand the market for
an enterprise investigative infrastructure.

EnCase® Enterprise serves as the platform to an enterprise investigative infrastructure, upon which additional modules, such as
our EnCase® eDiscovery Suite and Automatic Incident
Response Suite, can be added to enhance and automate the search, collection, preservation and analysis of data in order to accomplish specific tasks, such as electronic discovery or computer security incident response. An enterprise investigative
infrastructure provides an organization with comprehensive policies, technical expertise, hardware, software and organizational structure that facilitates all types of digital investigations. We intend to continue raising awareness of the need for
an enterprise investigative infrastructure through directing our marketing efforts at C-level decision makers, sponsoring seminars featuring keynote speakers that have significant influence in the industry, continuing to educate our customers
through our sales efforts, professional services and training program offerings and working with our partners in the legal community to help them articulate the need for an enterprise investigative infrastructure to their clients. We believe we have
established a leadership position in this new industry as both a successful provider of digital investigative products and services and as a key thought leader helping to define the architecture and vision of digital investigations. We seek to
extend our leadership position in this industry by continuing to innovate and launch new products and services to address the increasingly complex needs of the digital investigation community.

Continue to drive revenue growth by pursuing new customers, providing additional products and services to our base of existing customers and
expanding internationally.

Our sales strategy is primarily focused on securing new customers in the United States in the corporate
and government markets. We plan to continue providing additional modules and services to existing EnCase® Enterprise customers to enhance their ability to realize the benefits of a total enterprise investigative infrastructure. Since a portion of our existing EnCase® Enterprise customers only have the introductory level
bundle of our EnCase® Enterprise software product,
our sales strategy for these customers focuses on follow-on sales of additional products, professional services and training. For the year ended December 31, 2006, we derived approximately 26% of our revenues from sales of products and services
outside the United States. We believe that there is a large opportunity to market and sell our EnCase® Enterprise solutions in the Europe, Middle East and Africa (EMEA) and Asia-Pacific regions, and therefore we are continuing to invest in sales and distribution infrastructure
to address these under-penetrated markets. In 2006 we opened a regional headquarters in EMEA, and also launched direct and indirect sales efforts in Canada, Mexico, Brazil, Japan and Singapore. Our products are now available in 11 languages,
including double-byte capability for Asian languages.

Continue to be a leading innovator in the investigative technology industry.

We plan to continue creating new software offerings that enable our customers to further leverage the power of our digital
investigation software solutions. We maintain an advanced research group that focuses on developing next generation concepts in digital investigative forensics by responding to user feedback and other key influencers in the digital forensics and
legal communities and monitoring industry and technology trends. In addition, our Professional Services Division is often engaged to build customized applications utilizing our



5



---

##### Table of Contents

EnScript® programming language for specific customer needs. Since we retain the ownership of the actual code used in such customized applications, we have the ability to develop future products
that are applicable to our broad customer base as a result of these professional engagements. When appropriate, we then turn these end products into separate add-on modules available for all customers or incorporate them into the general software
code base. We believe our in-house, proprietary approach to software development is a competitive advantage, and we plan to continue to maintain this approach in the future.

Continue to maintain our legal recognition as a barrier to entry into our industry.

We believe that EnCase® software is the leading digital investigative solution across the Global 2000 and among federal, state, local and foreign government agencies. We
continue to make great efforts to ensure that our products continue to be respected as the leading digital investigative solution. Our software products are designed to comply with United States federal and state rules of evidence and to withstand
legal challenges in civil and criminal proceedings. Our products have been used in thousands of criminal and civil cases in federal, state and foreign courts, and EnCase® software has been cited by name or discussed in over 35 judicial decisions or opinions, including at the appellate
court level. This process of judicial recognition and validation is a lengthy, time-consuming process that requires years of litigation and appeals, and cannot be easily replicated. We have had members of our team testify in court proceedings or
provide affidavits in connection with the development, credibility and proper use of our products. In addition, we place a strong emphasis on training our customers and users on the best practices of digital investigations and the use of our
products in such investigations to maintain a reputation for reliability. We also publish the EnCase® Legal Journal and white papers on certain key topics of interest to our user community to further this effort.

Drive a network effect around our software.

We believe that as we continue to train or certify more users on our software products, these users will help us to drive wider adoption of EnCase® Enterprise and emphasize the importance of an enterprise investigative infrastructure. In the year ended
December 31, 2006, we trained thousands of individuals through approximately 3,800 paid courses on various computer forensics and EnCase® software topics, and we offered our training services in 20 countries and seven languages. In turn, the increasing use of EnCase® Enterprise by corporations and federal, state, local
and foreign government agencies will continue to drive the need for more users to become trained on our software product offerings, particularly since our training course offerings and EnCE® certification program often make these individuals more sought after in the job
marketplace. We believe our annual user conference, known as the Computer and Enterprise Investigations Conference, has become the leading gathering place for the computer forensics and digital investigations industry. Our 2006 Computer and
Enterprise Investigations Conference had approximately 700 participants, and we will continue to hold this conference to allow our users to connect, share and learn about important topics and products in the computer forensics and digital
investigations industry. We also provide all of our users with an online community where they can share ideas with each other and provide feedback to us on the products. Through this online community, hundreds of customized EnScript programs that
automate specific processes when run on EnCase®
Enterprise or EnCase® Forensic have been published
by, and downloaded from, our large user community. In addition, certain third parties have written commercial applications that utilize the EnScript programming language to leverage the capabilities of EnCase® software. We believe this community of developers and users helps to drive a network
effect that contributes substantially to our competitive barriers to entry, and we intend to continue to actively drive this network effect in the future.

Emphasize customer satisfaction.

Our user community has grown to encompass IT and forensics
investigators at a significant number of federal and state governments, local investigative bodies and corporations. We believe this loyal user base is one of our most valuable assets. We maintain a separate group within our sales organization that
is responsible for calling on existing customers to ensure full customer satisfaction. We have implemented a program that includes



6



---

##### Table of Contents

a follow-up visit to certain new customers approximately three months after implementation to confirm customer satisfaction and respond to user questions and
functionality issues. In order to promote better customer service, we have also expanded our customer support hours, which are now available 24 hours a day during the business week, while maintaining technical support services to our customers 24
hours per day, 7 days per week.

Products and Services

Our products and services give our customers the ability to conduct comprehensive, cost-effective and precise digital investigations. Our EnCase® Enterprise software, enhanced with our eDiscovery Suite and our Automatic Incident Response Suite products, provide the
foundation to build an enterprise investigative infrastructure. Furthermore, we believe our EnCase® Forensic software is the industry standard for searching, collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court
proceedings. We also offer a comprehensive array of forensic investigation and training services to help our customers manage their internal digital investigations and learn how to effectively and efficiently use our software.

EnCase® Enterprise Software

EnCase® Enterprise provides an investigative platform that enables an organization to search,
collect, preserve and analyze data on the servers, desktops and laptops on its computer network. EnCase® Enterprise enables organizations to conduct internal investigations, whether HR-related or focused on compliance or fraud, collect and preserve data in response to requests from
regulators or for civil litigation matters and take decisive action in the face of security and data breaches, whether the origin of the worm, virus or other exploit is internal (e.g., rogue employees) or external (e.g.,
hackers).

EnCase® Enterprise serves as the platform to an enterprise investigative infrastructure, to which additional modules, such as our EnCase® eDiscovery Suite and Automatic Incident Response Suite,
can be added to enhance and automate the search, collection, preservation and analysis of data in order to accomplish specific tasks, such as electronic discovery or computer security incident response. EnCase® Enterprise products consist of five separate components: the Examiner, the SAFE, the
Servlet, the Enterprise Concurrent Connection and SnapShot.

Examiner. The Examiner provides the user with a graphical user
interface through which the user can access, interact and enable the various capabilities of EnCase® Enterprise. Key features of the Examiner include advanced filtering, multiple case management, the ability to search and analyze structured and unstructured data and multi-lingual
support.

SAFE. The SAFE (Secure Authentication for EnCase®) is primarily an authentication tool that ensures that the Examiner is properly credentialed before permitting the
Examiner to access a server, desktop or laptop on the network. The SAFE allows the organization to control the Examiners access to information, which is critical to ensuring the proper segregation of duties and restricting access to sensitive
information. The SAFE also controls communications between EnCase® Enterprise components, encrypts data transfer between such components and controls user authentication. Every connection between any two computers is uniquely encrypted and controlled by the SAFE to prevent
circumvention of the system or the theft of data in transit.

Servlet. The Servlet is a small, non-intrusive piece of software that
is deployed on each server, desktop or laptop to which investigative access is sought. The Servlet is designed to be easily deployed over the network across thousands of servers, desktops and laptops within hours and not to interfere with any
existing applications or processes. The Servlet enables the Examiner to access information on the target server, desktop or laptop, including the contents of both static and volatile memory.

Enterprise Concurrent Connection. The Enterprise Concurrent Connection is a single secure virtual connection established between the Examiner and
the servers, desktops or laptops that are being searched or investigated. In essence, the Enterprise Concurrent Connection is a licensing tool limiting the number of



7



---

##### Table of Contents

computers that can be analyzed simultaneously; the greater the number of Enterprise Concurrent Connections that are licensed, the more quickly the
organization can search large quantities of data residing on its servers, desktops and laptops.

Snapshot. Snapshot is an add-on
module to EnCase® Enterprise that captures data and
information stored in the Random Access Memory (RAM) of servers, desktops and laptops on an organizations network. Information such as the listings of the logged-on users, open ports and open files currently in use on a system,
applications and active processes currently running on the system and the live registry are located in RAM. Snapshot captures this information and provides the user with an easy-to-use report on what was occurring on a system at a given point in
time. The Snapshot technology enables the user to scan thousands of computers to detect, collect, preserve and remediate any network intrusion on an enterprise-wide scale. It is also used to determine the scope of certain eDiscovery or human
resources investigations.

EnCase® eDiscovery Suite

The
EnCase® eDiscovery Suite automates the search,
collection and preservation of data across multiple servers, desktops or laptops on an organizations network. The user is able to utilize the EnCase® eDiscovery Suite to search specifically targeted computers and collect only the potentially relevant information, thereby eliminating the
collection, processing and review of meaningless or duplicate information. The EnCase® eDiscovery Suite allows the user to search and collect data from servers, desktops or laptops throughout the enterprise, and searches can be conducted based on a variety of criteria, including, but not limited
to, by file type, keywords, custodian, file digital fingerprint, or metadata such as creation, modified or last accessed times, or any combination of these criteria. The EnCase® eDiscovery Suite is able to collect individual files, including the associated
metadata, while preserving the data in its original state, including, uniquely, the associated metadata.

The EnCase® eDiscovery Suite collects and preserves data based on
the selected search criteria provided by the user. The search and collection of data can be performed around the clock on an automated basis, and can be scaled to the size of large enterprises. The software enables large-scale collections to be
performed across the network without disrupting business or the network or taking servers off-line. The EnCase® eDiscovery Suite tracks collection results in a database, so that at any given time, the status of the data collection effort can be viewed and communicated to others. The collected data
is placed in a secure virtual container called a Logical Evidence File, and the data can be further analyzed through EnCase® software or can then be uploaded to third-party eDiscovery attorney review platforms.

Information Assurance Suite

We have recently introduced for sale to government organizations our EnCase® Information Assurance Suite. The suite is comprised of four key subcomponents:



| |  |  | Classified Message Incident (CMI) module. Ensuring the proper access of classified documents is a high priority mandate for government agencies of all
types. The CMI module enables security professionals to comprehensively search a government network to locate classified documents, and, if required, delete them.
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | AIRS module. Automated Incident Response Suite is included in the Information Assurance suite to provide automated computer security incident detection and
response.
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | IAVA Compliance. Information Assurance Vulnerability Audit (IAVA) compliance is a federal standard that requires all government desktops, servers and
laptops to be properly patched at all times. Our IAVA compliance module enables our government customers to audit their networks to check their compliance and identify machines that are not properly patched.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Infocon Hardening. Government customers are particularly sensitive to their networks of desktops, servers and laptops being exposed to malware or unapproved
applications. The Infocon Hardening module enables an organization to identify and delete applications, malware and computing processes that are running across their servers, desktops and laptops.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



8



---

##### Table of Contents

Automated Incident Response Suite

Automated Incident Response Suite (AIRS) is an add-on to the EnCase® Enterprise solution that enables both reactive and proactive incident response.

For reactive incident response, AIRS integrates with the information security alerting systems of our customers, which include data leakage prevention,
intrusion detection, and enterprise security management products. AIRS enables an organization to automate the traditionally time-consuming process of incident detection and response. With AIRS, alerts trigger automated retrieval of volatile data,
and can also retrieve hard drive data to search for malware, including hidden processes such as rootkits, keystroke loggers and other forms of spyware. Rootkits are typically hidden applications that provide ongoing and unauthorized access to
computers. Keystroke loggers are applications that record the computer users keystrokes and deliver the information to a third party. Spyware is any application that is installed without the computer users informed consent, and has the
ability to change, collect, and transmit information about the users activities to a third party. Each event from the alerting system sent to AIRS goes through a two-step triage process to filter out false positives and assess whether a
computer was actually compromised. AIRS can then delete the malware from the affected servers, desktops, and laptops. In addition, depending on the severity of the event, as defined by the alerting system and the initial triage, AIRS automatically
follows up with additional data retrieval to identify any activity that has occurred on the affected servers, desktops, and laptops after the initial triggering event. The event data from the alerting system and the supporting near-time data
collected by AIRS is aggregated into a database that enables thorough analysis by incident responders and security analysts.

For proactive
incident response, a customer can use AIRS to sweep its network to identify and delete malware from its servers, desktops, and laptops. Most information security products, such as anti-virus, host intrusion detection and personal firewall software,
cannot detect many of the hidden processes that AIRS can identify and remediate. In addition, since AIRS can be used on a proactive basis, our customers can track the frequency and severity of their malware outbreaks.

EnCase® Forensic Software

EnCase® Forensic software is the leading tool for searching, collecting, preserving and
analyzing computer forensic data and authenticating such data in court. EnCase® Forensic enables an investigator to conduct the full array of forensic functions on a single machine while preserving the integrity of the evidence for future use in court. Used by investigators and consultants in law
enforcement, government agencies, small businesses, consulting firms and corporations, EnCase® Forensic software provides a robust way to authenticate, search and recover computer evidence rapidly and thoroughly.

EnCase® Forensic has the same capabilities as the Examiner in our EnCase® Enterprise software, other than the capability to search across networks. Computer evidence recovered with EnCase® Forensic software has been accepted and admitted into thousands of court proceedings in
several countries.

FastBloc® Write-Blocking Hardware and Software

FastBloc® hardware and software is used to
connect EnCase® Forensic to a hard drive to which
investigators have physical access. FastBloc®
hardware acts as a middleman between the operating system and the hard drive and physically blocks any hard drive write requests. This is a system primarily used by law enforcement and is designed to provide the investigator an extra level of
protection against the possibility of original evidence being damaged on the hard drive.

In 2006, we released FastBloc® SE, the first commercial software write-blocking
solution that allows EnCase® software to take full
control of IDE, SATA and SCSI channels on particular PCI controller cards, as well as the FireWire and USB ports from Windows, thereby permitting an extra level of protection against damaging original evidence without the use of hardware
write-blocking devices. In addition, FastBloc® SE
allows forensic investigators or consultants to override and access host-protected areas and device configuration overlays.



9



---

##### Table of Contents

Cell Phone Solution Initiative

We are in the process of developing an investigative solution, called Neutrino, where our court-accepted EnCase® Forensic technology can be used to help investigators recover, search, analyze and report on cellular phone data.

Professional Services

Our Professional Services Division provides various consulting services to our clients, including eDiscovery, Network Security Incident Response, Civil/Criminal digital investigation and implementation services. In addition, we offer
certain packaged services based on the specific needs of our customers, including our government customers. We recently received security clearances that enable us to better service our Department of Defense customers.

eDiscovery. Our consultants provide professional eDiscovery services to clients. Using the power of the EnCase® Enterprise and eDiscovery Suite software, our consultants are able to
significantly reduce the amount of data collected, thereby reducing the costs and time of processing, hosting, reviewing and producing data relevant to a particular discovery request.

Network Security Incident Response. We provide sophisticated network security incident response services to our clients. Using EnCase® Enterprise software, including SnapShot, our
consultants seek to locate the data that tells what really happened in a security breach, and to pinpoint the actual method of entry. Our consultants also provide customized EnScript® programming language development, integration services with respect to information
security alerting systems, and can also remediate unknown or malicious processes.

Civil/Criminal Digital Investigations. We employ
a team of trained criminal/civil computer investigation consultants, many from law enforcement or military backgrounds, who are skilled at conducting computer forensics analysis. Our computer forensics consulting engagements range from
straightforward human resources or computer misuse matters to far-reaching complex intellectual property theft investigations. Our consultants also provide expert testimony and present evidence in connection with digital investigations.

Implementation of EnCase® Enterprise. We provide implementation and consulting services in connection with the deployment of our EnCase® Enterprise software. Our implementation typically takes three to five days, during
which we conduct performance tests to ensure full functionality and integration with existing systems in the organization and provide on-site training to ensure our customers can maximize the use of the EnCase® Enterprise technology. Our consultants are encouraged to recommend our add-on products
to our customers in order to further enhance the capabilities of our EnCase® Enterprise software.

Packaged Consulting Services. We also offer pre-packaged services to serve
specific customer needs.



| |  |  | eRecords Management Audit. We recently began offering an eRecords Management Audit service, in which our consultants utilize EnCase® Enterprise software to audit a customers computers or servers for
compliance with its record retention policies. We search the individual files on the hard drives and servers of the system by file created and last accessed dates to identify those files that violate records retention
policies, and provide the client with a detailed report identifying the files that are out of compliance. In addition, if desired we can also remediate the offending files from the system.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Compromise Assessment. We offer a packaged Compromise Assessment service in which our experts use EnCase® Enterprise software to scan a set number of computers or servers on a clients
network to identify malicious code and remediate where necessary.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Customer Service and Technical Support

Customers typically purchase software maintenance with each new product license. Customer support generally involves software
updates, telephone and e-mail support, on a 24 hour per day, 5 days per week basis, as well as customer self-service on our website. Customers are typically provided an option to renew their



10



---

##### Table of Contents

maintenance agreements on an annual basis. Our technical support organization provides product support to our current customers on a single-tiered offering
and includes support availability 24 hours per day, 5 days per week, in English, and is also available during normal business hours in several other languages, including Japanese, Chinese, German and Spanish.

Training

Our Training
Division trains thousands of students per year in computer forensics principles and the use of our EnCase® software. Because of the sensitive nature of digital investigations and the need to conduct digital investigations in a forensically sound manner, our users will typically take one or
more of our courses. We provide an array of training courses on topics such as computer forensics, digital investigations, the proper use of our software products and the EnScript® programming language, which teach our customers IT and data security professionals the basic principles of
computer forensics, train them on the basic and advanced capabilities of our software products and teach them to write EnScript® programs. We have retained third-party training partners in order to provide training around the world. Our extensive training program has enabled us
to create a human capital knowledge base that can expand the recognition and demand for our products and services.

We operate two training
classrooms in Pasadena, California, two near Washington, D.C., and one near London, England. In addition, our authorized training partners offer certain courses in the U.S., Canada and Australia. In 2006, we conducted training classes in 20
different countries. In addition to offering courses in English, we have begun to localize our courses by converting the course content and manuals into other languages, and delivering the courses in those languages. To date, we have created courses
in German, Spanish, Korean, Romanian, Polish and Japanese, and we are currently developing courses in Chinese.

Each of our courses
involves 32 hours of classroom instruction. Many of our courses are eligible for credit from a variety of organizations, including the State Bar of California, the International Information Systems Security Consortium, Inc., the National Association
of State Boards of Accountancy, Association of Certified Fraud Examiners, the Texas Commission on Law Enforcement and the California Commission on Peace Officer Standards and Training. We are continually expanding our training offerings and we
believe that we are the leading corporate provider of this type of digital investigation training.

As of December 31, 2006, we
offered the following training courses:



| |  |  | EnCase® Forensic Courses (for EnCase® Forensic Users);
| | - |  | ------------------------------------------------------



| |  |  | EnCase® v6 Essentials;
| | - |  | ----------------------



| |  |  | EnCase® Intermediate Analysis and Reporting;
| | - |  | --------------------------------------------



| |  |  | EnCase® v6 Advanced Computer Forensics;
| | - |  | ---------------------------------------



| |  |  | EnCase® Enterprise Courses (for EnCase® Enterprise Users);
| | - |  | ----------------------------------------------------------



| |  |  | EnCase® Enterprise v6Phase I;
| | - |  | ------------------------------



| |  |  | EnCase® Enterprise v6Phase II;
| | - |  | -------------------------------



| |  |  | EnCase® FIM v6 (Field Intelligence Model/Mobile EE) Live Forensic Investigations;
| | - |  | ---------------------------------------------------------------------------------



| |  |  | EnCase® eDiscovery;
| | - |  | -------------------



| |  |  | Expert Courses (for Computer Forensics Professionals);
| | - |  | ------------------------------------------------------



| |  |  | EnCase® Advanced Internet Examinations;
| | - |  | ---------------------------------------



| |  |  | EnCase® EnScript® ProgrammingPhase I;
| | - |  | --------------------------------------



| |  |  | EnCase® EnScript® ProgrammingPhase II;
| | - |  | ---------------------------------------



| |  |  | EnCase® Network Intrusion InvestigationsPhase I;
| | - |  | -------------------------------------------------



11



---

##### Table of Contents

| |  |  | EnCase® Network Intrusion InvestigationsPhase II;
| | - |  | --------------------------------------------------



| |  |  | EnCase® NTFS I: NTFS Artifacts and File Systems; and
| | - |  | ----------------------------------------------------



| |  |  | EnCase® NTFS II: Windows Networking Investigations.
| | - |  | ---------------------------------------------------

EnCE® Certification

The EnCE® program certifies the competency of public and private sector employees in the best practices of computer forensic investigations and in the proper use
of our EnCase® software products while conducting
such investigations. In order to obtain EnCE®
certification, professionals must have at least 18 months of total investigative experience with at least six months experience in computer forensic investigations, complete extensive training requirements and pass a dual-phase EnCE® examination. EnCE® certification acknowledges that professionals have mastered computer forensic
investigation methodology as well as the use of EnCase® software during complex computer examinations. Our EnCE® program is recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, and EnCE® certification illustrates that an investigator is a skilled computer examiner. As of December 31, 2006, more than
900 people worldwide had achieved EnCE®
certification.

Technology

Both our
EnCase® Enterprise and EnCase® Forensic software share three primary components of our
technology.

EnCase® Evidence File

Our EnCase® Evidence File and EnCase® Logical Evidence File are proprietary solutions that streamline the collection
and preservation of digital evidence in investigations. The Evidence File authenticates the digital evidence by verifying that the digital fingerprint and checksums of small blocks of the collected data matches up with the original data. Our
technology can verify the data on-the-fly, such that when a user attempts to view any portion of the evidence, it is instantly verified for authenticity first. By collecting the digital evidence from the investigator at the time of collection and
writing that data into our EnCase® Evidence Files,
we are able to track the chain-of-custody and significantly reduce the burden on the investigator to authenticate the evidence in court. Our customers can use our EnCase® Logical Evidence File to store individual files or fragments of data and preserve them in the Logical Evidence File.
The EnCase® Logical Evidence File is a significant
component of our eDiscovery products and services.

The key benefits provided by the EnCase® Evidence File are that it:



| |  |  | authenticates that the preserved digital evidence is in fact what was originally collected;
| | - |  | -------------------------------------------------------------------------------------------



| |  |  | prevents damage to the digital evidence by human error;
| | - |  | -------------------------------------------------------



| |  |  | documents the chain-of-custody;
| | - |  | -------------------------------



| |  |  | eliminates cross-contamination concerns;
| | - |  | ----------------------------------------



| |  |  | provides several different means to connect and collect the digital evidence; and
| | - |  | ---------------------------------------------------------------------------------



| |  |  | significantly reduces the need for storage resources.
| | - |  | -----------------------------------------------------

Specialized Hard Drive Access

While most software applications interact and work within the
operating system, we have designed our software to run beneath the operating system in order to prevent interference from the operating system and ensure that data is not tampered with or modified. By working beneath the operating
system, our technology accesses the hard drive at the sector level, which is the smallest writeable area on a hard drive. It reads data from



12



---

##### Table of Contents

the sectors on the hard drive in a raw format and makes the entire hard drive accessible to the user of our software, including all files and obscure areas.
Importantly, areas of the hard drive that common users cannot access, such as unallocated space and unformatted space are also made accessible through our technology. While scanning the hard drive, our technology does not modify the metadata, such
as filenames, dates, and times, on live systems, which enables our customers to conduct a complete examination of all the data on the hard drive while assuring that the impact on the overall computing environment is substantially non-invasive. This
process is critical in order to preserve the forensic integrity of the preserved data.

EnScript® Technology

We have designed a proprietary advanced programming language called EnScript® that permits the development of applications that run inside the EnCase® software environment. EnCase® software acts as the operating system for these applications. The EnScript® language is optimized for our software and enables our
users to quickly write powerful applications that are highly customized to their needs. The EnScript® language permits not only Guidance Software to develop these applications, but also any other highly skilled programmer, organization or customer who so desires. The EnScript® program can be compiled so the source code is not
available to others, thereby allowing developers and organizations to protect their intellectual property. In addition to our own development efforts, EnScript® programs are commonly developed by persons not affiliated with Guidance Software, and are distributed throughout the
different investigative communities and organizations.

EnCase® Enterprises Network Level Capability

Our EnCase® Enterprise software extends the capabilities of our EnCase® Forensic software to enable our customers to scan hundreds of thousands of servers, desktops and laptops over a network to provide scalable
enterprise-class performance. Using EnCase®
Enterprise, our customers can focus on the computers in question in a massive enterprise-scale investigation or emergency, analyze data or files on a network, including volatile memory using SnapShot, and preserve only the data necessary for the
investigation into our EnCase® Logical Evidence
File. To accomplish this network-level capability securely, we designed and patented a security architecture that is based on a three-tier structure, which includes a Servlet, an Examiner and a SAFE server.

Designed to work across multiple operating systems, our EnCase® Enterprise serves as an investigative platform, the foundation of an enterprise investigative infrastructure, when
fully implemented on a network. Our software is currently compatible with many systems, such as:



| |  |  | Operating Systems: Windows 95/98/NT/2000/XP, Windows 2003 Server, Macintosh, Linux Kernel 2.4 and above, Solaris 8/9 (both 32-bit and 64-bit), AIX, and OS X.
| | - |  | -------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | File Systems: FAT12, FAT16, FAT32, NTFS, Macintosh HFS, HFS+, Sun Solaris UFS, Linux EXT2/3, Reiser, BSD FFS, Palm, TiVo Series One and Two, AIX JFS, JFS, Joliet,
UDF and ISO 9660.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Sales

We sell our product offerings directly to customers using our direct sales representatives and our internal sales staff and indirectly through third-party value-added resellers, or VARs. As of December 31, 2006, we employed 151
individuals who were involved in our selling and marketing efforts, and had agreements with over 50 third-party distributors.

The sales
model for our EnCase® Enterprise products and
services involves a high degree of specialization based on the size and sales focus of the target customer. We primarily utilize direct sales field representatives to sell our EnCase® Enterprise products and related services to large and mid-market corporate customers,
which we classify as customers with at least $250 million in revenues that are not assigned to specific sales persons. For our largest corporate customers, individual members of our sales force generally target a named list of accounts and work to
develop and cultivate long-term relationships with the companies they contact. For our mid-market corporate customers, our direct sales representatives focus on specific regions and certain named accounts in those regions and work to develop
relationships in each region.



13



---

##### Table of Contents

Our internal sales staff is responsible for sales of our EnCase® Enterprise products and related services to companies that are not large enough to fall
within the mid-market customer group. Our internal sales staff is also generally responsible for sales of our EnCase® Forensic products and our training services. A large portion of the business for our EnCase® Forensic product is generated from pre-existing relationships, allowing our internal
sales personnel to execute at a high level of efficiency. Our internal sales personnel spend the bulk of their time targeting our EnCase® Forensic product to law enforcement agencies.

In addition to our corporate sales field representatives and our internal sales force, we have a sales team dedicated to our federal customers, a professional services sales force designed to specifically promote sales of professional
services to new and existing customers, and a law firm sales force targeted at selling to law firm customers and strategic partners. These teams typically use a direct sales model to focus on those specific verticals given the unique selling
dynamics that exist in each target market.

In 2005, we commenced a focused effort to expand international sales. International sales
constituted approximately 26% of our sales in the year ended December 31, 2006. Outside of the United States, excluding the United Kingdom, we typically utilize third-party VARs to sell our products to our international customers. In the United
Kingdom, we utilize a direct sales model similar to the system in place in the United States.

Marketing

We believe that organizations can realize significant benefits by installing EnCase® Enterprise across their networks as a foundation to build an enterprise investigative infrastructure. Our marketing
strategy involves communicating the value of our products as the foundation on which to build an enterprise investigative infrastructure to organizations.

We direct our marketing resources heavily towards focused events programs, where we sponsor networking seminars in different geographic regions where executives and prospective customers can learn from high profile
industry individuals about important topics in the digital investigation industry. Our annual user conference, Computer and Enterprise Investigations Conference, also provides a valuable forum for users to connect, share information and learn about
important topics in the industry.

Our marketing strategy mirrors our sales strategy in that it is segmented by product offering and target
market. In marketing our EnCase® Forensic product,
we attempt to maximize our brand recognition by introducing new products and features to our established domestic customer base and by focusing our marketing efforts on foreign markets. We place great emphasis on mass marketing techniques such as
webinars, e-mails and regional events to showcase our technology and product offerings. For our EnCase® Enterprise products and related services, we tailor our marketing strategy to each target market segment.

Pricing Strategy

Often, customers of our EnCase® Enterprise product begin with an introductory bundle that consists of one SAFE, one
Examiner and three Concurrent Connections and, as they expand their use of the software and build their enterprise investigative infrastructure, they purchase additional components. We price EnCase® Enterprise primarily by component (such as the number of SAFEs, Examiners, and
Concurrent Connections each customer purchases), although for smaller customers there is a pricing option available based on the size of the customers computer network (such as the number of servers, desktops and laptops on the customers
network). In most instances, however, the Servlet is freely deployable at no charge, because we want to encourage our customers to deploy EnCase® Enterprise to every server, desktop and laptop on their networks. The eDiscovery Suite and Automated Incident Response Suite are each priced based on
the size of the customers computer network.

We price EnCase® Forensic in two different ways. First, to the law enforcement and government market it is sold at a fixed price with
bundled maintenance fees, with periodic upgrades that must be purchased separately if the customer wishes to continue to receive support and product upgrades beyond 12 months from purchase.



14



---

##### Table of Contents

Second, to the corporate market it is sold at a fixed price with maintenance fees required for support and product upgrades. In addition, we offer a Premium
License Support Program, which is a subscription arrangement entitling the customer to receive unspecified future products and post-contract customer support for a period of several years. If a customer purchases our Premium License Support Program,
an annual payment option or a lump sum payment option is available.

Consulting and implementation services are typically billed on a per
hour or per disk drive basis or are provided under fixed fee arrangements depending on the scope and size of each individual project.

Our
training services are typically priced on a per class per seat basis.

Customers

Our customers include government agencies and global corporations in a wide variety of industries such as financial and insurance services, technology,
defense contracting, telecom, pharmaceutical, manufacturing and retail. Our EnCase® Enterprise customer base currently includes more than 100 of the Fortune 500 and many federal and international government agencies, and we have deployed our EnCase® Forensic software to more than 1,000 government and law enforcement agencies and other
customers worldwide. Our EnCase® Enterprise
customers are primarily in North America, and also extend to Europe, Africa, the Middle East and Asia/Pacific Rim. Sales to customers outside of the United States accounted for 23%, 25% and 26% of our revenues for the fiscal years ended
December 31, 2004, 2005, and 2006, respectively. The majority of our EnCase® Forensic customers are national and local government agencies, law enforcement agencies and other organizations of the United States government. No customer accounted for more than 10% of our total revenue in 2004,
2005, or 2006.

Customer Satisfaction Program

We believe superior customer support is important to retaining and expanding our customer base. In addition to our comprehensive technical support offerings that assist customers in maximizing the value they get from our product and
services, we have created our customer satisfaction program. This program assigns one of our executive sponsors to certain key accounts to maintain direct and formal post-sale interactions, including planned follow-ups with customers after
implementation, both on-site and via teleconference. Further, our professionally trained personnel assist in the use of the EnScript® programming language to help automate manual tasks.

Research and Development

Our research and development effort is focused on the advancement of our core products and the
development of new products, as well as the quality assurance of both core and new products. We conduct research on existing or new computer hardware or software technology to develop solutions for our law enforcement, government or corporate
markets. We conduct research on file system support, search and analysis algorithms, hardware engineering and design, industry standards, technology integrations and user productivity and performance features. Our research and development efforts
are often aimed at creating new standards in our industry and streamlining current processes. Under our customer contracts, we typically obtain the rights to use any improvements to our technology developed or discovered on a particular customer
deployment on other customer deployments. Our research and development expense was, $3.3 million in 2004, $4.7 million in 2005, and $7.1 million in 2006.

Competition

The market for digital investigation solutions is extremely competitive, highly fragmented and subject to
rapidly changing technology, shifting customer needs and frequent introductions of new products and services. We believe that the principal competitive factors in this market include depth and breadth of forensic technology,



15



---

##### Table of Contents

forensic soundness and acceptance in court, time required to complete an investigation, ability to scale across large networks, expertise of consulting
personnel and total solution cost. We expect the intensity of competition to increase in the future as new companies enter our markets, existing competitors develop stronger capabilities, and as we expand into other markets. Many of our current
competitors have longer operating histories, greater name recognition, access to larger customer bases and substantially more extensive resources than we have. They may be able to devote greater resources to the development, promotion and sale of
their products than we can to ours, which could allow them to respond more quickly than we can to new technologies and changes in customer needs and achieve wider market acceptance. We expect to continue to face competition from new entrants.

We compete directly with a significant number of established companies that have developed or are developing and marketing software and
applications that currently compete or will compete with our product and service offerings. While no single company competes with us across all of our markets, we face significant competition in each of the core markets in which we operate. Our
current principal competitors include:



| |  |  | computer forensic companies that develop forensic tools that compete with our EnCase® Forensic product;
| | - |  | -------------------------------------------------------------------------------------------------------



| |  |  | managed security services companies which offer managed incident response services which compete against our incident response services; and
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | consulting companies, such as the Big 4 consulting/accounting firms and Kroll Ontrack, that offer consulting services for traditional digital investigations and
eDiscovery in place of implementing a packaged software solution.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

We also compete indirectly with a significant number
of established companies or organizations that have developed or are developing and marketing software or services that may diminish the need for our solutions or the budget available to our customers to purchase our solutions. Our current principal
indirect competitors include:



| |  |  | traditional security companies such as McAfee and Symantec, that offer blocking and monitoring technologies for incident response;
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------



| |  |  | storage infrastructure companies, such as EMC, ZANTAZ and Symantec, which advertise some eDiscovery capabilities to complement their core product offerings around
content management, e-mail archiving and storage software;
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | internal IT organizations that develop their own security systems; and
| | - |  | ----------------------------------------------------------------------



| |  |  | providers of corporate insurance to the Global 2000, whose policies permit and pay for the use of consulting or other services to defend against a specific case but
not the purchase of products or software to enhance the overall digital investigative capability for the company.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Intellectual
Property and Proprietary Rights

Our intellectual property rights are important to our business. We rely on a combination of copyrights,
trade secrets, trademarks, and patents, as well as confidentiality procedures and contractual provisions to protect our proprietary technology, processes and intellectual property. We currently have two U.S. patents and eleven patent applications
pending in the United States, the European Union or under the Patent Cooperation Treaty (often more than one pending application relates to a single invention). We own registered copyrights on various versions of our products and associated
instructional documentation. We currently have registered trademarks or trademarks in the United States and in certain other jurisdictions, including the mark EnCase® in the United States, Japan and the European Union, and in the marks EnCE®, EnScript® , FastBloc®, CEIC® in the United States. We currently have pending trademark applications for the marks Guidance Software and Neutrino in the United States.

Others may develop products that are similar to our technology. We generally enter into confidentiality and other written agreements with our employees
and partners, and through these and other written agreements, we attempt to control access to and distribution of our software, documentation and other proprietary technology and



16



---

##### Table of Contents

other information. Despite our efforts to protect our proprietary rights, third parties may, in an unauthorized manner, attempt to use, copy or otherwise
obtain and market or distribute our intellectual property rights or technology or otherwise develop a product with the same functionality as our software. Policing unauthorized use of our software and intellectual property rights is difficult, and
nearly impossible on a worldwide basis. Therefore, we cannot be certain that the steps we have taken or will take in the future will prevent misappropriation of our technology or intellectual property rights, particularly in foreign countries where
we do business or where our software is sold or used, where the laws may not protect proprietary rights as fully as do the laws of the United States or where the enforcement of such laws is not common or effective.

Substantial litigation regarding intellectual property rights exists in the software industry. From time to time, in the ordinary course of business, we
are subject to claims relating to our intellectual property rights or those of others, and we expect that third parties may commence legal proceedings or otherwise assert intellectual property claims against us in the future, particularly as we
expand the complexity and scope of our business, the number of similar products increases and the functionality of these products further overlap. These claims and any resulting litigation could subject us to significant liability for damages. In
addition, even if we prevail, litigation could be time-consuming and expensive to defend and could affect our business materially and adversely. Any claims or litigation from third parties may also limit our ability to use various business
processes, software and hardware, other systems, technologies or intellectual property subject to these claims or litigation, unless we enter into license agreements with the third parties. However, these agreements may be unavailable on
commercially reasonable terms, or not available at all.

In addition to our proprietary technology, we rely on technology that we license
from third parties. In particular, the next version of our products will incorporate document viewer technology that we license from Stellent, Inc. Our license agreement with Stellent expires on December 15, 2008, and may be renewed by us for
an additional two year term at a higher price. In addition, Stellent may terminate this license agreement prior to the expiration of its term if we fail to make timely payments or fail to comply with any other material term of the license. See
Risk FactorsOur success depends in part upon our ability to develop new products and enhance our existing products. Failure to successfully introduce new or enhanced products to the market may adversely affect our business, financial
condition and results of operations.

Employees

As of December 31, 2006, we employed 346 full-time employees, including 60 in research and development, 151 in selling and marketing and 50 in our Professional Services Division. We have never had any work
stoppage and none of our employees are represented by a labor organization or are party to any collective bargaining arrangements. We consider our employee relations to be good.

Available Information

We file reports with the Securities and Exchange Commission (SEC).
We make available on our website under Investors/SEC Filings, free of charge, our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to those reports as soon as reasonably practicable
after we electronically file such materials with or furnish them to the SEC. Our website address is www.guidancesoftware.com. Please note, however, that the information contained on the website is not incorporated by reference in, or
considered part of, this annual report. You can also read and copy any materials we file with the SEC at the SECs Public Reference Room at 100 F Street, NE, Washington, DC 20549. You can obtain additional information about the operation of the
Public Reference Room by calling the SEC at 1-800-SEC-0330. In addition, the SEC maintains an Internet site (www.sec.gov) that contains reports, proxy and information statements, and other information regarding issuers that file
electronically with the SEC, including us.



17



---

##### Table of Contents

|Item 1A. | Risk Factors
|-------- | ------------

You should consider each of the
following factors as well as the other information in this Annual Report in evaluating our business and our prospects. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties not presently known
to us or that we currently consider immaterial may also impair our business operations. If any of the following risks actually occurs, our business and financial results could be harmed. In that case, the trading price of our common stock could
decline. You should also refer to the other information set forth in this Annual Report, including our financial statements and the related notes.

Our operating results may fluctuate from period to period and within each period, which makes our operating results difficult to predict and could cause our revenues, expenses and profitability to fall short of
expectations during certain periods.

Our operating results may fluctuate from period to period or within certain periods as a
result of a number of factors, many of which are outside of our control. You should not rely on our past results as an indication of future performance, as our operating results in the future may fall below expectations, expenses could increase and
revenues could decrease. Each of the risks described in this section, as well as other factors, may affect our operating results. For example, our quarterly revenues and operating results may fluctuate as a result of a variety of factors, including,
but not limited to, our lengthy sales cycle, the proportion of revenues attributable to license fees versus services and maintenance revenue, changes in the level of fixed operating expenses, demand for our products and services, the introduction of
new products and product enhancements or upgrades by us or our competitors, changes in customer budgets and capital expenditure plans, competitive conditions in the industry and general economic conditions. In addition, many customers make major
software acquisitions near the end of their fiscal years, which tends to cause our revenues to be higher in the third and fourth calendar quarters, the fiscal year ends of many government agencies and corporations, and lower in the first calendar
quarter. In addition, many customers tend to make software acquisitions or purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of the period in question
until software purchase decisions have been made. Since our EnCase® Enterprise product sales are generally large scale license agreements, a short delay in just one of these software sales from one quarter into a subsequent quarter or a loss of one of these potential sales could cause
us to deliver results for a quarter that are below projections of securities analysts that follow our results. This could cause our stock price to decline significantly. There can be no assurance that we will be able to successfully address these
risks, and we may not be profitable in any future period.

If the corporate market for digital investigation software were not to
develop, we would not be able to maintain our growth, and our revenues and results of operations would be adversely affected.

The
market for digital investigation software is new and is being developed largely through our efforts. Our growth is dependent upon, among other things, the size and pace at which the market for such software develops. If the market for such digital
investigation software decreases, remains constant or grows more slowly than we anticipate, we will not be able to maintain our recent rate of growth. Continued growth in the demand for our products is uncertain resulting from, among other things,
the fact that:



| |  |  | customers and potential customers may decide to use traditional methods of conducting enterprise investigations, such as reliance on in-house professionals or
outside consultants to conduct manual investigations;
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | customers may experience technical difficulty in utilizing digital investigation software or otherwise not achieve their expected return on their investment in such
software; and
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | marketing efforts and publicity related to digital investigation software may not be successful.
| | - |  | ------------------------------------------------------------------------------------------------

Even if digital investigation software gains wide market acceptance, our software may not adequately address market requirements and may not continue to
gain market acceptance. If digital investigation software generally, or our software specifically, do not gain wide market acceptance, we may not be able to maintain our recent rate of growth and our revenues and results of operations would be
adversely affected.



18



---

##### Table of Contents

The failure of the legal community to adopt our eDiscovery Suite solution could negatively affect
future sales of EnCase® Enterprise, which could
have a material adverse effect on our results of operations.

We expect to derive a significant amount of sales of EnCase® Enterprise from continuing demand for our EnCase® eDiscovery Suite solution. However, widespread adoption
of eDiscovery best practices will require a shift in the way the legal community approaches discovery of electronic documents and other electronically stored data. Currently, most large scale electronic discovery projects are conducted by outsourced
service providers that manually retrieve documents from each computer subject to review. These service providers have longstanding and entrenched relationships with the corporations that are subject to large-scale discovery inquiries or security
breaches and the large law firms that are typically retained in connection with such discovery projects. Corporations and law firms may continue to prefer to use service providers because of these ongoing established relationships, and because the
service providers are widely known and accepted within the legal community and may resist adoption of our EnCase® eDiscovery Suite solution. Moreover, the expense of relying on an outsourced service provider may frequently be covered by the corporations insurance policy that is otherwise
covering the expense of the litigation, including complying with requests for discovery, while implementation of EnCase® Enterprise and our EnCase® eDiscovery Suite would require a significant unreimbursed capital expenditure by the corporation. The failure of corporations and law firms to adopt
our EnCase® eDiscovery Suite or our solutions to be
used for eDiscovery could have a material adverse effect on our sales and results of operations.

Courts could reject the use of our
products, which would harm our reputation and negatively affect future sales of our products and services.

Our software products
and services are often used in connection with legal investigations, civil litigation and criminal prosecutions. The admissibility of results generated by our products as evidence in civil and criminal trials is a key component of our customer value
proposition. Evidence and the manner used to collect evidence is regularly the subject of challenges in legal investigations and litigation, and our products or personnel may be the direct or indirect subject of such legal challenges. Persons
involved in litigation may, for example, challenge the reliability of our products, the admissibility of evidence generated, discovered or collected using our products, and/or the expertise, credibility or reliability of our personnel. Other
unpredictable legal challenges may be brought that could reflect upon the reputation of our products or personnel. To date, courts that have addressed challenges to our products or services have ruled against such challenges. If in the future a
court were to find that our products are not reliable or that persons representing us or users of our product are not credible, reliable or lack the expertise necessary to serve as a witness or to authenticate evidence, or that our training and
certification process does not adequately prepare individuals to conduct competent digital investigations, this could have a material adverse impact on our revenues and results of operations.

We are dependent on our management and research and development teams, and the loss of any key member of either of these teams may prevent us from
executing our business strategy.

Our future success depends in a large part upon the continued services of our executive officers
and other key personnel. In particular, Shawn McCreight, our founder, Chairman and Chief Technology Officer, has been significantly responsible for the development of our products. In addition, John Colbert, our Chief Executive Officer, has been
responsible for a number of our significant strategic initiatives. We are also substantially dependent on the continued services of our existing research and development personnel. We have fewer research and development employees than many
competitors of comparable size due to the high degree of expertise required to work with our complex technology and our stringent hiring standards. The loss of one or more of our key employees, and in particular our research and development
personnel, could seriously harm our business development, culture and strategic direction. We do not maintain key person life insurance policies on any of our executives. Any key person life insurance policy we maintain now or in the future would
not be sufficient to cover the loss of any of our key personnel and any such loss could seriously harm our business and our ability to execute our business strategy.



19



---

##### Table of Contents

Changes or reforms in the law or regulatory landscape could diminish the need for our solutions,
and could have a negative impact on our business.

One factor that drives demand for our products and services is the legal and
regulatory framework in which our customers operate. Laws and regulations are subject to drastic changes and these could either help or hurt the demand for our products. Thus, certain changes in the law and regulatory landscape, such as tort law or
legislative reforms that limit the scope and size of electronic discovery requests or the admissibility of evidence generated by such requests, as well as court decisions, could significantly harm our business. Changes in domestic and international
privacy laws could also affect the demand and acceptance of our products, and such changes could have a material impact on our revenues.

We face direct and indirect competition from other software companies, as well as other companies that provide training, consulting and certification services in computer forensics, which could limit our growth and market share.

The markets for our software products and services are competitive, highly fragmented and subject to rapidly changing technology,
shifting customer needs and frequent introductions of new products and services. We expect the intensity of competition to increase in the future as new companies enter our markets, existing competitors develop stronger capabilities and we expand
into other markets. Many of our current competitors have longer operating histories, greater name recognition, access to larger customer bases and substantially more extensive resources than we have. They may be able to devote greater resources to
the development, promotion and sale of their products than we can to ours, which could allow them to respond more quickly than we can to new technologies and changes in customer needs and achieve wider market acceptance. Because the barriers to
entry into software industry segments are generally low, we expect to continue to face competition from new entrants, particularly as we expand into other segments of the software industry.

Several competing companies provide digital investigation software and applications that directly compete or will compete with our products, or offer
solutions our products do not address. In addition, if the market for digital investigation software develops as we anticipate, other companies could enter this market through their own software development or through the acquisition of one of our
current competitors. If these companies are more successful in providing similar, better or less expensive digital investigation solutions compared to those that we offer, we could experience a decline in customers and revenue. These companies
include computer forensic companies, managed security services companies and consulting companies, such as the Big 4 consulting/accounting firms, many of which have substantially greater resources and customer bases than we do. If our
competitors are more successful than we are at generating professional services engagements, our growth rate or revenues may decline.

We
also compete with companies or organizations that have developed or are developing and marketing software and services that diminish the need for our solutions or the budget available to our customers to purchase our solutions. These companies
include traditional security companies, data storage infrastructure companies and internal IT organizations that develop their own security systems. We also compete indirectly with providers of corporate insurance to the Global 2000, whose policies
in question permit and pay for the use of consulting and other services to defend in litigation but not the purchase of digital investigation software to enhance the overall capabilities for a company.

Computer hackers may damage our products, services and systems, which could cause interruptions in our service and harm to our business, and
hackers could gain access to our customers personal information which could result in the loss of existing clients, negative publicity and legal liability.

Computer hackers often attempt to access information, including personal information for purposes of identify theft and other criminal activity. In particular, due to the nature of our business, the products and
services that we offer and the industry in which we operate, we are more likely to be the target of computer hackers who would like to undermine our ability to offer the products and services that we provide to our customers and possibly retaliate
for the results or evidence that our products and services generate.



20



---

##### Table of Contents

For example, in December 2005, we became aware of a security breach of our electronic records which
contained, among other things, credit card information of approximately 5,000 customers. We promptly notified law enforcement authorities as well as each of the customers whose information may have been compromised. We conducted a forensic
examination of the incident and took a number of steps to both remediate the underlying cause and strengthen our internal security system, including enhancing our internal information technology security department and redesigning our network
architecture.

In early January 2006, the Federal Trade Commission (the FTC) commenced an inquiry into the December 2005
security breach. On September 20, 2006, we executed a consent decree proposed by the FTC that includes no monetary penalties. The consent decree finds that we failed to implement proper security measures to protect consumers data, and
requires us to provide the FTC with initial and biennial third party assessments of our IT security for a period of 10 years. Additionally, the consent decree requires us to maintain a comprehensive IT security program, retain documentation of such
program and provide notice of the consent decree to our executives and employees for a period of 20 years. The FTC formally approved the consent decree on November 15, 2006 and subsequently issued a press release announcing the investigation
and its conclusion. Following the FTC press release, there commenced a public comment period of 30 days. Although we are not aware of any material objections received by the FTC during the comment period, we await final notification from the FTC
that the decree has become effective and the matter is formally concluded.

In addition, several customers who were notified have sought
compensation, which in each case has been satisfied by payment of amounts which are not material to us. One customer has commenced litigation against us, which was dismissed by a federal court but may be refiled in state court. In connection with
this breach, we have paid $11,500 in fines to credit card processing companies. However, we may still face additional legal and administrative action with respect to the incident. In addition, the incident received publicity and could adversely
affect our ability to retain and attract customers. Given the incident, any subsequent breach of our security could be especially damaging to our reputation and business and may result in monetary penalties if the FTC were to find that the
circumstances that lead to the breach constituted a violation of our obligations under the consent decree.

In addition, from time to time
we may be targets of computer hackers who, among other things, create viruses to sabotage or otherwise attack companies networks, products and services. For example, there was recently a spread of viruses, or worms, that intentionally deleted
anti-virus and firewall software. Our products, networks, websites and systems, may be the target of attacks by hackers. If successful, any of these events could damage our computer systems, force us to incur substantial costs to fix technical
problems or result in hackers gaining access to our technical and other proprietary information, which could harm our business and results of operations.

If we fail to develop or maintain an effective system of internal controls, we may not be able to accurately or timely report our financial results or prevent fraud. As a result, current and potential
stockholders could lose confidence in our financial reporting, which would harm our business and the trading price of our common stock.

Effective internal controls are necessary for us to provide reliable financial reports and effectively prevent fraud and to operate successfully as a public company. If we cannot provide reliable financial reports or prevent fraud, our
reputation and operating results would be harmed. We have in the past discovered, and may in the future discover, areas of our internal controls that need improvement.

In November 2006, in conjunction with the audit of our financial statements for the nine months ended September 30, 2006, our independent registered public accounting firm reported to our audit committee
material weaknesses in our internal controls of financial reporting. In addition, in connection with the audit of our financial statements for the year ended December 31, 2005, in July 2006, our independent registered public
accounting firm reported to our audit committee several matters that are material weaknesses in our internal



21



---

##### Table of Contents

controls over financial reporting. A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a
remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected.

The
material weaknesses reported by our independent registered public accounting firm in connection with their audit of our financial statements for the nine months ended September 30, 2006, are summarized below:



| |  |  | We did not have adequate controls to provide reasonable assurance that revenue was being recorded in accordance with generally accepted accounting principles. The
inadequate controls resulted in the premature recognition of revenue that should have been deferred to a later period, in accordance with AICPA Statement of Position 97-2, Software Revenue Recognition (SOP 97-2) and AICPA Technical
Practice Aid, TIS Section 5100.69. Specifically, in the third quarter of 2005, we improperly recognized revenue in the amount of $244,000 prior to delivery of the related products. As a result of this error, an adjustment was recorded to our
books and records and financial statements to defer revenue previously recorded during the quarter ended September 30, 2005 until the quarter ended December 31, 2005. The error resulted in a restatement of the previously reported quarterly
results. See Managements Discussion and Analysis of Financial Condition and Results of OperationsAccounting Restatements.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We did not have adequate controls and procedures to assure proper accounts payable accruals for services rendered and billed but not yet paid, and, as a result, we
recorded post-closing adjustments to our books and records and financial statements for the nine months ended September 30, 2006.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

In conjunction with the audit of our financial statements for the twelve months ended December 31, 2006 our independent registered public accounting firm noted that the internal controls put in place had not yet
remediated the above material weakness.

The material weaknesses reported by our independent registered public accounting firm in
connection with their audit of our financial statements for the year ended December 31, 2005, are summarized below:



| |  |  | We did not have personnel within our accounting function that possessed an appropriate level of experience in the selection and application of GAAP to provide
reasonable assurance that transactions were being appropriately recorded. Additionally, the training of employees and written communication regarding duties and control responsibilities was inadequate to ensure that processes and control activities
were being carried out effectively.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We did not have adequate controls to provide reasonable assurance that all elements of contractual arrangements with customers were being recorded in accordance
with GAAP. Specifically, we did not have adequate controls to properly determine the frequency of upgrades and enhancements. Significant errors involved customer contracts consisting of multiple elements, such as license, professional services and
maintenance fees. Errors in allocating revenue among these elements resulted in the premature recognition of revenue that should have been deferred to later periods, in accordance with SOP 97-2 and related interpretations. As a result of these
identified deficiencies, material revenue-related post-closing adjustments were recorded to our financial statements to defer revenue from the periods in which they were originally recorded until such time as the appropriate revenue recognition
criteria were met. In addition, other revenue recognition related errors were identified resulting primarily from a lack of secondary review over the application of accounting principles to specific contract terms as well as the analysis and
estimates supporting the amounts recorded. These errors resulted from the lack of a systematic process for accumulating information underlying recorded revenue as well as the lack of appropriate levels of review.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We did not have adequate controls and procedures with respect to the reconciliation of general ledger account balances to supporting detail; recording and analysis
of certain accounts, including capitalized software development costs, lease transactions, accounts payable, stock compensation, asset disposals; and documentation of non-routine transactions. As a result of these material weaknesses, we recorded
material post-closing adjustments to our financial statements.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



22



---

##### Table of Contents

In 2006, we began our remediation efforts and we believe that our actions in this regard have
strengthened our internal controls over financial reporting. Although initiated, our plan to improve the effectiveness of our internal controls and processes is not complete. It will take some time to put in place the rigorous disclosure controls
and procedures desired by our management and our board of directors. While we expect to complete this remediation process as quickly as possible, doing so depends on several factors beyond our control, including the hiring of additional qualified
personnel and, as a result, we cannot at this time estimate how long it will take to complete the steps identified above. Our management will continue to evaluate the effectiveness of the control environment and will continue to refine existing
controls. We cannot make assurances that the measures we have taken to date or any future measures will remediate the material weaknesses reported by our independent registered public accounting firms. Additional deficiencies in our internal
controls may be discovered in the future. Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our operating results or cause us to fail to meet our reporting
obligations and may result in a restatement of our prior period financial statements. Ineffective internal controls could also cause investors to lose confidence in our reported financial information, which would likely have a negative effect on the
trading price of our common stock.

We also have not yet implemented a complete disaster recovery plan or business continuity plan for our
accounting and related information technology systems. Any disaster could therefore materially impair our ability to maintain timely accounting and reporting.

We face risks related to our accounting restatements, including negative publicity, which could harm our business and reputation and cause the value of our common stock to decline.

In connection with the audit of our financial statements for the period ended September 30, 2006, we discovered that we had not properly applied
certain accounting guidance contained in American Institute of Certified Public Accountants Statement of Position (SOP) 97-2, Software Revenue Recognition. Specifically, we had improperly recognized revenue prior to delivery of the related products
in the third quarter of 2005. We restated the unaudited quarterly data for the three months ended September 30, 2005 and December 31, 2005, presented in Note 17 to the consolidated financial statements filed in conjunction with our
Registration Statement on Form S-1, to correctly recognize revenue upon delivery (the 2005 Restatement). The 2005 Restatement resulted in a decrease to revenue and net income for the three months ended September 30, 2005 and a
corresponding increase to revenue and net income for the three months ended December 31, 2005.

In connection with the audit of our
2005 financial statements and the identification of material weaknesses previously described above, we discovered accounting inaccuracies in our previously audited financial statements and accordingly restated our results with regard to the year
ended December 31, 2004 and prior years. We determined that we had not properly applied certain accounting guidance contained in Statement of Position (SOP) 97-2 Software Revenue Recognition and related interpretations.
The improper application of these principles resulted in the premature recognition of revenue that should have been deferred to later periods.

In addition, during 2004, we incorrectly applied the provisions of Statements of Financial Accounting Standards (SFAS) No. 86, Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise
Marketed. Specifically, we capitalized software development costs that should have been expensed. Our restated 2004 consolidated financial statements reflect additional research and development expense which had previously been capitalized.
Our 2003 balance sheet was also restated to recognize real property leasehold incentives that previously were not accounted for in our financial statements.

If we are required to restate our financial statements in the future, we may be the subject of negative publicity focusing on the financial statement inaccuracies and resulting restatement. In addition, our financial
results as restated may be more adverse than originally reported. In the past, certain publicly traded companies that have restated their financial statements have been subject to shareholder actions. The occurrence of any of the foregoing could
harm our business and reputation and cause the price of our common stock to decline after this offering.



23



---

##### Table of Contents

Our operating results and business would be seriously impaired if our revenues from our EnCase® Enterprise product were to decline.

Historically, we have derived substantially all of our license revenues from sales of our EnCase® Forensic and EnCase® Enterprise product offerings. Although we have introduced new software modules, we
expect that our EnCase® Enterprise product offering
will account for the largest portion of our software product for the foreseeable future. Although we have no reason to believe that sales of EnCase® Forensic will decline in future periods, we believe that the degree of penetration for our EnCase® Forensic product in the law enforcement market makes it unlikely that revenue from
sales of EnCase® Forensic will contribute
dramatically to future revenue growth. For this reason, we are dependent on increased sales of EnCase® Enterprise to drive future growth.

As a result, if for any reason revenue
from our EnCase® Enterprise product offerings
declines or does not increase as rapidly as we anticipate, our operating results and our prospects for growth will be significantly impaired. Further, if these products fail to meet the needs of our existing and target customers, or if they do not
compare favorably in price and performance to competing products, our business will be adversely affected.

We may be limited in our
ability to utilize indirect sales channels, such as value-added resellers, corporate resellers, professional services firms and other third-party distributors for the sale and distribution of our products, which may limit our ability to expand our
customer base and our revenues.

We may be limited in our ability to market and distribute our products through value-added
resellers, corporate resellers, professional services firms and other third-party distributors, which we collectively refer to as third-party resellers, due to various factors. Due to the complex nature of our products, sales professionals generally
require a significant amount of time and effort to become sufficiently familiar with our products in order to be able to market them effectively, which makes our products unattractive to third-party resellers. In addition, our competitors include
professional services organizations, such as accounting, consulting and law firms, that would otherwise serve as a natural distribution channel for our products and related services.

Moreover, there is significant competition in our industry for qualified third-party resellers. Even if we were to succeed in attracting qualified and
capable third-party resellers, we would likely have relatively short-term contracts and no minimum purchase commitments with any existing and future third-party resellers. In addition, agreements with such third-party resellers are generally
renewable annually, not exclusive and may be terminated by either party within 30 days after the initial six-month period of the agreement, and with 30 days notice after the initial one-year period. If we are not able to recruit new qualified
third-party resellers, our sales growth may be constrained and our results of operations would suffer.

Our intellectual property
rights are valuable, and if we are unable to protect our proprietary technologies and defend infringement claims, we could lose our competitive advantage and our business could be adversely affected.

Our success depends in part on our ability to protect our proprietary products and services and to defend against infringement claims. If we are unable to
do so, our business and financial results may be adversely affected. To protect our proprietary technology, we rely upon a combination of copyright, patent, trademark and trade secret law, confidentiality restrictions in contracts with employees,
customers and other third parties, software security measures, and registered copyrights, trademarks and patents. If we fail to protect our intellectual property rights adequately, our competitors may gain access to our technology, and our business
may be harmed. Any of our patents, trademarks, copyrights or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation proceedings. In addition, we may be unable to obtain patent,
copyright or trademark protection on products that we spend significant time and expense to develop in the future. Despite our efforts to protect our proprietary technology, unauthorized persons may be able to copy, reverse engineer or otherwise use
some of our proprietary technology. Furthermore, existing patent and copyright laws may afford only limited protection, and the laws of certain countries in which we operate do not



24



---

##### Table of Contents

protect proprietary technology as well as established law in the United States. For these reasons, we may have difficulty protecting our proprietary
technology against unauthorized copying or use. If any of these events happen, there could be a material adverse effect on the value of our proprietary technology and on our business and financial results. In addition, litigation may be necessary to
protect our proprietary technology. This type of litigation is often costly and time-consuming, with no assurance of success.

Claims
that we misuse the intellectual property of others could subject us to significant legal liability and disrupt our business, which could have a material adverse effect on our financial condition and results of operations.

Because of the nature of our business, we may become subject to material claims of infringement by competitors and other third parties with respect to our
current or future software applications, trademarks or other proprietary rights. The legal framework for software patents is rapidly evolving and we expect that software developers will increasingly be subject to infringement claims as the number of
software applications and competitors in our industry segment grows. In certain circumstances, the owners of proprietary software could make copyright and/or patent infringement claims against us in connection with such activity. Any such claims,
whether meritorious or not, could be time consuming and difficult to defend against, result in costly litigation, cause shipment delays or require us to enter into royalty or licensing agreements with third parties, which may not be available on
terms that we deem acceptable, if at all. Any of these claims could disrupt our business, make it difficult to add or retain important features in our products and have a material adverse effect on our financial condition and results of operations.

If we are unable to continue to obtain government licenses, approvals or authorizations regarding the export of our products abroad,
or if current or future export laws limit or otherwise restrict our business, we could be prohibited from shipping our products to certain countries, which could negatively impact our business, financial condition and results of operations.

We must comply with United States laws regulating the export of our products to other countries. Our products contain encryption
and decryption technologies that require us to obtain certain licenses from the United States government in order to export certain of our products abroad. In addition, we are required to obtain licenses from foreign governments in order to import
our products into these countries. We cannot assure you that we will be successful in obtaining such licenses, approvals and other authorizations required from applicable governmental authorities to export our products. The export regimes and the
governing policies applicable to our business are subject to change, and we cannot assure you that such export approvals or authorizations will be available to us or for our products in the future. Our failure to receive any required export license,
approval or authorization would hinder our ability to sell our products and could negatively impact our business, financial condition and results of operations.

We have grown rapidly, and if we are not able to effectively manage and support our growth or retain and attract highly skilled employees, our business strategy might not succeed.

In the past we have grown rapidly and we will need to continue to grow in all areas of our operations to execute our business strategy. Managing and
sustaining our growth will place significant demands on management as well as on our administrative, operational, technical and financial systems and controls and other resources. We may not be able to expand our product offerings, our customer base
and markets, or implement other features of our business strategy at the rate or to the extent presently planned. In addition, our traditionally high level of customer service may suffer as we grow, which could cause our software sales to suffer. If
we are unable to successfully manage or support our future growth, we may not be able to maximize revenues or profitability.

In addition,
in order to be able to effectively execute our rapid growth plan, we must attract and retain highly qualified personnel. We will need to hire additional personnel in virtually all operational areas, including selling and marketing, research and
development, professional services, training, customer service and



25



---

##### Table of Contents

administration. Competition in our industry for experienced and qualified personnel in these areas is extremely intense, especially for software developers
with high levels of experience in designing and developing software products and sophisticated technical sales people experienced in selling our complex type of software product and selling into government agencies. In order to expand sales of
EnCase® Enterprise, we must continue to hire highly
qualified commissioned sales personnel to directly target potential EnCase® Enterprise customers. These new commissioned sales personnel require several quarters of training and experience before being able to effectively market EnCase® Enterprise, and, as a result of these hires, our sales and marketing expense will
increase at a greater rate than our revenue, at least in the short term. The expense of hiring and training these commissioned sales personnel may never generate a corresponding increase in revenue. We may not be successful in attracting and
retaining the necessary qualified personnel that our growth plan requires. We have from time to time in the past experienced, and we expect to continue to experience in the future, difficulty in hiring and retaining highly skilled employees with
appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. If we fail to attract new personnel or retain and motivate our current personnel, our business and future growth
prospects could be severely harmed.

We also believe that a critical contribution to our successful rapid growth has been our corporate
culture which fosters innovation, teamwork and excellence. As our organization grows and we are required to implement more complex organizational structures and institutional programs, we may find it difficult to maintain the beneficial aspects of
our corporate culture, which could negatively affect our ability to attract and retain qualified and experienced personnel and therefore our future success in continuing to maintain our rapid growth.

Our failure to offer high quality training and to attract and retain high quality training personnel could have a material adverse effect on our
sales of software applications and therefore have a negative impact on our business, financial condition and results of operations.

Our services offerings include training programs designed to instruct current and potential customers on the proper process of conducting a competent digital investigation and the most efficient operation of our products. To a significant
degree, the pool of potential users of our products is created by the training services we and our partners provide. A high level of training is critical for the successful marketing, sale and implementation of our software products. Finding
qualified third-party providers of training services for our complex software products is difficult and time-consuming, and to date we have approved only five such providers. If we or our partners do not effectively train our customers to properly
use our software applications, or succeed in helping our customers quickly resolve post-deployment issues, it would adversely affect our ability to sell additional software products to existing customers in the future and could harm our reputation
with potential customers of software products. As a result, our failure to attract and maintain high quality training representatives and personnel would have a material adverse effect on our sales of software applications and therefore negatively
impact our business, financial condition and results of operations.

Our software applications may be perceived as, or determined by
the courts to be, a violation of privacy rights. Any such perception or determination could adversely affect our revenues and results of operations.

Because of the nature of digital investigations, our potential customers and purchasers of our products or the public in general may perceive that use of our products for these investigations result in violations of
individual privacy rights. In addition, certain courts, legislative and regulatory authorities could determine that the use of our software solutions or similar products are a violation of privacy rights, particularly in jurisdictions outside of the
United States. Any such determination or perception by potential customers, the general public, government entities or the judicial system could harm our reputation and adversely affect the sales of our products and our results of operations.

Our business could be adversely affected based on the fact we have chosen to enter into United States General Services
Administration (GSA) contracts as a procurement vehicle for federal government agencies that purchase certain of our products and services. These GSA contracts require that we provide our best



26



---

##### Table of Contents

corporate prices to the government agencies and give the government agencies the right to conduct administrative audits of our performance under such
GSA contracts. If we have an unfavorable administrative audit we may be required to reimburse the United States government for costs that they have expended under such contracts and our ability to bid and compete for future contracts with government
agencies may be materially impaired.

We have chosen to enter into GSA contracts in connection with the sale of certain of our
products and services. These GSA contracts are intended to facilitate efficient sales to government agencies and provide the government agencies with most-favored nation type pricing for the respective products and services on a
comparable basis with sales to other third parties. In addition, the GSA and government agencies which purchase our products and services pursuant to GSA contracts are permitted to conduct administrative audits of us as part of their routine audits
and investigations of government contracts. For example, the GSA conducted an audit of Guidance for 2005 and issued to us an administrative report card with a rating of successful. In addition, the GSA has provided notice that it will
conduct an administrative audit for 2006. As part of the audit process, the GSA or a government agency may review our performance under the contract, cost structure, including the cost of comparable products and services to third parties, and
compliance with applicable laws, regulations and standards. The GSA or a government agency may also review the adequacy of, and our compliance with, our internal controls systems and policies, including our purchasing, property, estimating,
compensation and management information systems. If any of our pricing is found to be improperly discounted to a specific contract, the revenue received by us may have to be refunded and an additional penalty may have to be paid by us. For the year
ended December 31, 2005 and 2006, our billings from federal government contracts procured through the GSA were 22% and 17% of total billings, respectively.

A future audit with unfavorable results could materially affect our competitive position and result in a material adjustment to our financial results. In addition, if a GSA or government agency audit uncovers improper
or illegal activities on our part, we may be subject to civil and criminal penalties and administrative sanctions, including, but not limited to, termination of existing contracts, forfeiture or disgorgement of profits, suspension of future payments
owed, fines and suspension from doing future business with the federal government through the GSA. Furthermore, our reputation could suffer serious or irreparable harm if allegations of impropriety were levied against us. If we were suspended from
contracting through the GSA, our reputation or relationships with federal government agencies were impaired, or the GSA or these agencies otherwise ceased doing business with us or significantly decreased the amount of business they do with us, our
revenues and prospects would be materially harmed.

In December, 2006, the Company entered into a Government Reseller Agreement with
immixTechnology, to sell the Companys products via the immixTechnology General Services Administration (GSA) contract to government customers. The Company expects that the use of the immixTechnology GSA contract will
facilitate future business and enable the Company to benefit from industry best practices of selling to the government.

Our business depends, in part, on sales to governments and governmental entities and significant changes in the contracting or fiscal policies of governments and governmental entities could have a material adverse effect on our
business.

We derive a portion of our revenues from contracts with federal, state, local and foreign governments and government
agencies, and we believe that the success and growth of our business will continue to depend on our successful procurement of government contracts. Accordingly, changes in government contracting policies or government budgetary constraints could
directly affect our business, financial condition and results of operations. Among the factors that could adversely affect our business, financial condition or results of operations are:



| |  |  | changes in fiscal policies or decreases in available government funding;
| | - |  | ------------------------------------------------------------------------



| |  |  | changes in government programs or applicable requirements;
| | - |  | ----------------------------------------------------------



| |  |  | the adoption of new laws or regulations or changes to existing laws or regulations;
| | - |  | -----------------------------------------------------------------------------------



27



---

##### Table of Contents

| |  |  | changes in political or social attitudes with respect to security issues, computer crimes, discovery of computer files and digital investigations;
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | potential delays or changes in the government appropriations process; and
| | - |  | -------------------------------------------------------------------------



| |  |  | delays in the payment of our invoices by government payment offices.
| | - |  | --------------------------------------------------------------------

These and other factors could cause governments and governmental agencies to refrain from purchasing the products and services that we offer in the
future, the result of which could have an adverse effect on our business, financial condition and results of operations. In addition, many of our government customers are subject to stringent budgetary constraints. The award of additional contracts
from government agencies could be adversely affected by spending reductions or budget cutbacks at government agencies that currently use or are likely to utilize our products and services.

Because we offer our EnScript® programming language for customization of and the creation of add-ons for our EnCase® software, customers or third-party programmers may be able to develop products which
compete with our products or reduce the marketability or value of our products.

We have developed many of our major products,
including our EnCase® eDiscovery Suite and our
Automated Incident Response Suite, to function as applications running on the EnCase® Enterprise platform. We created these applications using the EnScript® programming language. In order to enhance the attractiveness of our EnCase® software to potential customers and position EnCase® software as a standard software for digital investigations, we have made available without charge the EnScript® programming language, which permits users of EnCase® software to develop customized add-on features for
their own or others use, and we have trained our customers on how to write add-on programs using the EnScript® programming language, which is similar to C++. As part of this strategy, we have encouraged the development of an active community of EnScript® programmers similar to those which have emerged for
other software products. While we believe widespread use of our EnScript® programming language will ultimately create demand for our products, customers in the past have developed, and may in the future develop, software for use with EnCase® software using the EnScript® programming language, rather than purchasing certain of our product offerings. Losses
of sales to potential customers could have a material adverse impact on our revenues and results of operations.

Our success depends
in part upon our ability to develop new products and enhance our existing products. Failure to successfully introduce new or enhanced products to the market may adversely affect our business, financial condition and results of operations.

Our future success depends in part on our ability to develop enhancements to our existing products and to introduce new products
that keep pace with rapid technological developments and changes in customers needs. Although our products are designed to operate on a variety of network hardware and software platforms, we must continue to modify and enhance our products to
keep pace with changes in network platforms, operating systems, software technology and changing customer demands. We may not be successful in developing and documenting these modifications and enhancements or in bringing them to market in a timely
manner. Any failure of our products to operate effectively with future network platforms and technologies could reduce the demand for our products and result in customer dissatisfaction. In addition, the next version of our products will incorporate
document viewer technology that we license from Stellent, Inc. Our license agreement with Stellent expires on December 15, 2008, and may be renewed by us for an additional two-year period at a higher price. In addition, Stellent may terminate
this license agreement prior to the expiration of its term if we fail to make timely payments or fail to comply with any other material term of the license agreement. We may be unable to replace this technology if Stellent terminates this license
agreement or it expires, or if the Stellent technology becomes obsolete or incompatible with our products.

Furthermore, any new products
that we develop may not be released in a timely manner and may not achieve the market acceptance necessary to generate significant sales revenues. As a result, we may expend significant time and expense towards research and development for new or
enhanced products, which may not



28



---

##### Table of Contents

gain market acceptance or generate sufficient sales to offset the costs of research and development. If we are unable to successfully develop new products or
enhance and improve our existing products, or if we fail to position or price our products to meet market demand, our business, financial condition and results of operations will be adversely affected.

Errors in our products could adversely affect our reputation, result in significant costs to us, impair our ability to market our products and
expose us to legal liability, any of which may adversely affect our operating results.

Products as complex as ours can contain
undetected errors or failures. Despite extensive testing by us and by our customers, we have in the past discovered errors in our software applications and will likely continue to do so in the future. As a result of past discovered errors, we
experienced delays and lost revenues while we corrected the problems in those software applications. In addition, customers in the past have brought to our attention bugs in our software exposed by the customers unique operating
environments. Although we have been able to fix these software bugs in the past, we may not always be able to do so in the future. In addition, our products may also be subject to intentional attacks by viruses that seek to take advantage of these
bugs, errors or other weaknesses. Any of these events may result in the loss of, or delay in, market acceptance of our products and services, which would seriously harm our sales, financial condition and results of operations.

Furthermore, we believe that our reputation and name recognition are critical factors in our ability to compete and generate additional sales of our
products and services. Promotion and enhancement of our brand name will depend largely on our success in continuing to provide effective software applications and services. The occurrence of errors in our software applications or the detection of
bugs by our customers may damage our reputation in the market as well as our relationships with existing customers, which may result in our inability to attract or retain customers.

In addition, because our products are used in security and forensic functions that are often critical to our customers, the licensing and support of our
products makes us potentially subject to product liability claims. Any product liability insurance we carry may not be sufficient to cover our losses resulting from any such product liability claims. The successful assertion of one or more large
product liability claims against us could have a material adverse effect on our financial condition.

Incorrect or improper use of
our products, our failure to properly train customers on how to utilize our software products or our failure to properly provide consulting and implementation services could result in negative publicity and legal liability.

Our products are complex and are deployed in a wide variety of network environments. The proper use of our software requires extensive training by the end
user and, if our software products are not used correctly or as intended, inaccurate results may be produced. Our customers or our professional services personnel may incorrectly implement or use our products. Our products may also be intentionally
misused or abused by customers or non-customer third parties who obtain access and use of our products. Because our customers rely on our product and service offerings to manage a wide range of sensitive investigations and security functions, the
incorrect or improper use of our products, our failure to properly train customers on how to efficiently and effectively use our products or our failure to properly provide consulting and implementation services to our customers may result in
negative publicity or legal claims against us.

We cannot predict our future capital needs and we may be unable to obtain additional
financing to develop new products, enhance existing products, offer additional services or fund strategic acquisitions, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

We may need to raise additional funds in the future in order to develop new products, enhance existing products, offer additional
services or make strategic acquisitions of complementary businesses, technologies, products or services. Any required additional financing may not be available on terms acceptable to us, or at all.



29



---

##### Table of Contents

If we raise additional funds by issuing equity securities, you will experience dilution of your ownership interest, which could be significant, and the
newly-issued securities may have rights senior to those of the holders of our common stock. If we raise additional funds by obtaining loans from third parties, the terms of those financing arrangements may include negative covenants or other
restrictions on our business that could impair our operational and financial flexibility and would also require us to incur additional interest expense. If additional financing is not available when required or is not available on acceptable terms,
we may be unable to successfully develop or enhance our software products and services through internal research and development or acquisitions in order to take advantage of business opportunities or respond to competitive pressures, which could
negatively impact our software products and services offerings and sales revenues, the failure of which could have a material adverse effect on our business, financial condition and results of operations.

Acquisitions that we may undertake in the future involve risks that could adversely affect our business, financial condition and results of
operations.

We may pursue strategic acquisitions of businesses, technologies, products or services that we believe complement or
expand our existing business, products and services. Acquisitions involve numerous risks, including, but not limited to, the following:



| |  |  | diversion of managements attention during the acquisition and integration process;
| | - |  | -----------------------------------------------------------------------------------



| |  |  | costs, delays and difficulties of integrating the acquired companys operations, technologies and personnel into our existing operations and organization;
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | adverse impact on earnings as a result of amortizing the acquired companys intangible assets or impairment charges related to write-downs of goodwill related
to any acquisition;
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | issuance of equity securities to pay for acquisitions, which may be dilutive to existing stockholders;
| | - |  | ------------------------------------------------------------------------------------------------------



| |  |  | potential loss of customers or key employees of acquired companies;
| | - |  | -------------------------------------------------------------------



| |  |  | impact on our financial condition due to the timing of the acquisition or our failure to meet operating or synergy expectations for any acquired business; and
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | assumption of unknown liabilities of the acquired company.
| | - |  | ----------------------------------------------------------

To date, we have not completed an acquisition. Any acquisitions of businesses, technologies, products or services that we may undertake in the future may not generate sufficient revenues or cost-saving synergies
necessary to offset the associated costs of the acquisitions or may result in other material adverse effects.

Our international
sales and operations are subject to factors that could have an adverse effect on our business, financial condition and results of operations.

We have significant sales and services operations outside the United States, and derive a substantial portion of our revenues from these operations. We also plan to expand our international operations in the future.
For the year ended December 31, 2006, we derived approximately 26% of our revenues from sales of products and services outside the United States.

Our international operations are subject to risks related to the differing legal, political, social and regulatory requirements and economic conditions of many countries, which risks include, but are not limited to:



| |  |  | difficulties in staffing and managing our international operations;
| | - |  | -------------------------------------------------------------------



| |  |  | the fact that foreign countries may impose additional withholding taxes or otherwise tax our foreign income, impose tariffs or adopt other restrictions on foreign
trade or investment, including currency exchange controls;
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | the general economic conditions in the countries in which we operate could have an adverse effect on our earnings from operations in those countries;
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------



30



---

##### Table of Contents

| |  |  | the imposition of, or unexpected adverse changes in, foreign laws or regulatory requirements, including those pertaining to export duties and quotas, trade and
employment restrictions;
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | longer payment cycles for sales in foreign countries and difficulties in collecting accounts receivable;
| | - |  | --------------------------------------------------------------------------------------------------------



| |  |  | U.S. and foreign import and export laws;
| | - |  | ----------------------------------------



| |  |  | fluctuations in currency exchange rates;
| | - |  | ----------------------------------------



| |  |  | compliance with multiple, conflicting and changing governmental laws and regulations, including tax, privacy and data protection laws and regulations;
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | costs and delays associated with developing software, documentation and training materials in multiple languages; and
| | - |  | ---------------------------------------------------------------------------------------------------------------------



| |  |  | political unrest, war or acts of terrorism occurring in the foreign countries in which we currently operate or intend to operate in the future.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------

We may not continue to succeed in developing and implementing policies and strategies that will be effective in each
location where we currently do business or intend to do business in the future. Furthermore, the occurrence of any of the foregoing factors may have a material adverse effect on our business, financial condition and results of operations.

Insiders control a majority of our outstanding stock, and this may delay or prevent a change of control of our company or adversely
affect our stock price.

As of March 5, 2007, our executive officers, directors and affiliated entities will together
beneficially own approximately 62.25% of our common stock outstanding, including 46.94% of our outstanding common stock held by our founder, Shawn McCreight, and his wife. As a result, these stockholders will have control over matters that require
approval by our stockholders, including the election of directors and approval of significant corporate transactions. Corporate actions favored by these stockholders might be taken even if other stockholders, including those who purchase shares in
this offering, oppose them. This concentration of ownership might also have the effect of delaying or preventing a change of control that other stockholders may view as beneficial.

Our charter documents and Delaware law may deter potential acquirers of our business and may thus depress our stock price.

Our amended and restated certificate of incorporation and our bylaws contain provisions that could delay or prevent a change of control of our company
that our stockholders might consider favorable. In addition, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which may discourage, delay or prevent certain business combinations with stockholders owning
15% or more of our outstanding voting stock. These and other provisions in our charter documents may make it more difficult for stockholders or potential acquirers to initiate actions that are opposed by the then-current board of directors,
including delaying or impeding a merger, tender offer, or proxy contest or other change of control transaction involving our company. Any delay or prevention of a change of control transaction could cause stockholders to lose a substantial premium
over the then current market price of their shares.

The trading price of our common stock is volatile.

The trading prices of the securities of technology companies have historically been highly volatile. Accordingly, the trading price of our common stock is
likely to be subject to wide fluctuations. Factors affecting the trading price of our common stock may include:



| |  |  | variations in our financial results;
| | - |  | ------------------------------------



| |  |  | announcements of technological innovations, new solutions, strategic alliances or significant agreements by us or by our competitors;
| | - |  | -------------------------------------------------------------------------------------------------------------------------------------



31



---

##### Table of Contents

| |  |  | recruitment or departure of key personnel;
| | - |  | ------------------------------------------



| |  |  | changes in the estimates of our financial results or changes in the recommendations of any securities analysts that elect to follow our common stock; and
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | market conditions in our industry, the industries of our customers and the economy as a whole.
| | - |  | ----------------------------------------------------------------------------------------------

In addition, if the market for software or other technology stocks or the stock market in general experiences continued or greater loss of investor
confidence, the trading price of our common stock could decline for reasons unrelated to our business or financial results. The trading price of our common stock might also decline in reaction to events that affect other companies in our industry
even if these events do not directly affect us.

Future sales of shares by existing stockholders could cause our stock price to
decline.

All of our outstanding shares are eligible for sale in the public market, subject in certain cases to volume limitations
under Rule 144 of the Securities Act of 1933, as amended. Also, shares subject to outstanding options and rights under our First Amended and Restated 2004 Equity Incentive Plan are eligible for sale in the public market to the extent permitted by
the provisions of various vesting agreements and Rules 144 and 701 under the Securities Act. If these shares are sold, or if it is perceived that they will be sold in the public market, the trading price of our common stock could decline.

In addition, our founder, Shawn McCreight, and his wife, continue to hold a substantial number of shares of our common stock. Sales by
Mr. McCreight or his wife of a substantial number of shares, or the expectation that such sales may occur, could significantly reduce the market price of our common stock.

If our prior S Corporation election was not properly made and maintained, we would be liable for federal and certain state income taxes

In October 1998, we elected to be treated for federal income tax purposes as an S Corporation under Subchapter S of the
Internal Revenue Code. In addition, we elected or were otherwise treated as an S Corporation for certain state tax purposes. As an S Corporation, our earnings were included in the income of our stockholders for federal and certain state income tax
purposes. We filed an election to revoke our S Corporation status on December 11, 2006. If your S Corporation election was not properly made and maintained prior to its revocation, we would be liable for federal and certain state income taxes
during prior open periods, together with interest thereon and, possibly, penalties. Such taxes and penalties may be material to our operating results.



|Item 2. | Properties
|------- | ----------

Our corporate headquarters is located
in Pasadena, California and we maintain offices near San Francisco, California, in Houston, Texas, in New York, New York, near Washington, D.C., and near London, England. We lease approximately 85,000 square feet of space for our corporate offices
in two locations in Pasadena, California. We also lease small regional facilities near San Francisco, California, in Houston, Texas, in New York, New York, near Washington, D.C., in Chicago, Illinois, and near London, England. Our leases expire at
various points through 2015. We believe that our current facilities are suitable and adequate to meet our current needs, and that suitable additional or substitute space will be available as needed to accommodate expansion of our operations.



|Item 3. | Legal Proceedings
|------- | -----------------

From time to time, we may become
involved in various lawsuits and legal proceedings that arise in the ordinary course of business. Litigation is subject to inherent uncertainties, and an adverse result in these or other matters may arise from time to time that may harm our
business. We are not currently aware of any such legal proceedings or claims that we believe will have, individually or in the aggregate, a material adverse effect on our business, financial condition or operating results.



32



---

##### Table of Contents

In early January 2006, the Federal Trade Commission (the FTC) commenced an inquiry into the
December 2005 security breach discussed in Risk FactorsComputer hackers may damage our products, services and systems, which could cause interruptions in our service and harm to our business, and hackers could gain access to our
customers personal information which could result in the loss of existing clients, negative publicity and legal liability. On September 20, 2006, we executed a consent decree proposed by the FTC that includes no monetary penalties.
The consent decree finds that we failed to implement proper security measures to protect consumers data, and requires us to provide the FTC with initial and biennial third-party assessments of our IT security for a period of 10 years.
Additionally, the consent decree requires us to maintain a comprehensive IT security program, retain documentation of such program and provide notice of the consent decree to our executives and employees for a period of 20 years. The FTC formally
approved the consent decree on November 15, 2006, and subsequently issued a press release announcing the investigation and its conclusion. Following the FTC press release, there commenced a public comment period of 30 days. Although we are not
aware of any material objections received by the FTC during the comment period, we await final notification from the FTC that the decree has become effective and the matter is formally concluded.



|Item 4. | Submission of Matters to a Vote of Security Holders
|------- | ---------------------------------------------------

On November 10, 2006, a special meeting of our stockholders was held at which our stockholders unanimously approved the following items:



| | (a) | The reincorporation of the Company in the State of Delaware, which was accomplished through a merger of Guidance Software, Inc., a California corporation (California
Guidance), with and into Guidance Software, Inc., a subsidiary of Guidance California established in Delaware (Delaware Guidance, of which Guidance California had owned all of the issued and outstanding shares of capital stock),
with Delaware Guidance as the surviving corporation;
| | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| | (b) | The amendment and restatement of the certificate of incorporation of Delaware Guidance upon consummation of the reincorporation merger;
| | --- | ---------------------------------------------------------------------------------------------------------------------------------------



| | (c) | The amendment and restatement of the bylaws of Delaware Guidance upon consummation of the reincorporation merger;
| | --- | -----------------------------------------------------------------------------------------------------------------



| | (d) | The entrance of Delaware Guidance into indemnification agreements with its officers and directors, either now or in the future appointed or elected to serve as such;
| | --- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------



| | (e) | The adoption of the 2004 Equity Incentive Plan by Delaware Guidance upon consummation of the reincorporation merger.
| | --- | --------------------------------------------------------------------------------------------------------------------



33



---

##### Table of Contents

PART II



|Item 5. | Market for Registrants Common Equity and Related Stockholder Matters
|------- | ---------------------------------------------------------------------

Our common stock has been traded on the NASDAQ Global Market under the symbol GUID since December 13, 2006. Prior to that time, there was no public market for our common stock. The following table
sets forth the range of high and low sales prices on the NASDAQ Global Market of the common stock for the periods indicated, as reported by NASDAQ.



|                                             |  |                    |       |     |   |      
|-------------------------------------------- |  | ------------------ | ----- | --- | - | -----
|                                             |  | Common Stock Price
|                                             |  | High               |       | Low
|Fiscal Year 2006                             |  |                    |       |     |   |      
|Fourth Quarter 2006 (From December 13, 2006) |  | $                  | 17.90 |     | $ | 12.75

As of March 9, 2007, there were 34 holders of record of our common stock. On March 9,
2007, the last sale price reported on the NASDAQ Global Market for our common stock was $11.70 per share.

In October 1998, we elected to
be treated for federal income tax purposes as an S Corporation under Subchapter S of the Internal Revenue Code. In addition, we elected or were otherwise treated as an S Corporation for certain state tax purposes. We filed an election to
revoke our S Corporation status on December 31, 2006. As an S Corporation, we historically paid dividends to our stockholders. We anticipate that any future earnings will be retained to finance continuing development of our business.
Accordingly, we do not anticipate paying dividends on our common stock in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors and will depend upon our results of operation,
financial condition and other factors as the board of directors, in its discretion, deems relevant.

Equity Compensation Plan Information

Information about our equity compensation plans at December 31, 2006 that were either approved or not approved by our stockholders
was as follows:



|                                                           |  |                                                               |  |                                                   |      |                                                     |        
|---------------------------------------------------------- |  | ------------------------------------------------------------- |  | ------------------------------------------------- | ---- | --------------------------------------------------- | -------
|Plan Category                                              |  | Number ofShares to beIssued UponExercise ofOutstandingOptions |  | WeightedAverageExercisePrice ofOutstandingOptions |      | Number ofSharesRemainingAvailablefor FutureIssuance
|Equity compensation plans approved by our stockholders(a)  |  | 3,904,000                                                     |  | $                                                 | 6.26 |                                                     | 840,000
|Equity compensation plans not approved by our stockholders |  |                                                              |  |                                                   |     |                                                     |       

---

|(a) | Includes our First Amended and Restated 2004 Equity Incentive Plan.
|--- | -------------------------------------------------------------------

Performance Measurement Comparison

The following graph illustrates a comparison of the total cumulative stockholder return
on our common stock since December 13, 2006, the date of our initial public offering, to two indices: (i) the Nasdaq Composite Index (symbol: IXIC) and (ii) the Nasdaq Computer (symbol: ^IXK) Index. The graph assumes an initial
investment of $100 on December 13, 2006 and that all dividends have been reinvested. No cash dividends have been declared on our common stock since the date of our initial public offering. The comparisons in the graph are required by the SEC
and are not intended to forecast or be indicative of the possible future performance of our common stock.



34



---

##### Table of Contents

LOGO



35



---

##### Table of Contents

|Item 6. | Selected Consolidated Financial Data
|------- | ------------------------------------

The following
selected consolidated financial data should be read together with Managements Discussion and Analysis of Financial Condition and Results of Operations and our consolidated financial statements and related notes included elsewhere
in this Annual Report. The selected consolidated balance sheet data as of December 31, 2005 and 2006 and the selected consolidated statement of operations data for each of the three years in the period ended December 31, 2006, have been
derived from our audited consolidated financial statements, which are included elsewhere in this Annual Report. The selected consolidated balance sheet data as of December 31, 2002, 2003 and 2004 and selected consolidated statement of
operations data for the years ended December 31, 2002 and 2003 have been derived from our audited consolidated financial statements not included in this Annual Report. Historical results are not necessarily indicative of the results to be
expected in the future.



|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|-------------------------------------------------------------------- |  | ------------------------------------- | ------ | - | ---- | - | ------ | ---- |  | - | ------ | - |  | ---- | ------ | - |  | - | ------ | -
|                                                                     |  | Year Ended December 31,               |       
|                                                                     |  | 2002                                  |        |   | 2003 |   |        | 2004 |  |   | 2005   |   |  | 2006 |       
|                                                                     |  | (in thousands, except per share data) |       
|Consolidated Statements of Operations Data:                          |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Revenues:                                                            |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Product revenue                                                      |  | $                                     | 6,059  |   |      | $ | 9,752  |      |  | $ | 15,812 |   |  | $    | 23,138 |   |  | $ | 32,565 |  
|Services and maintenance revenue                                     |  |                                       | 4,475  |   |      |   | 7,949  |      |  |   | 11,792 |   |  |      | 16,367 |   |  |   | 23,300 |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Total revenues                                                       |  |                                       | 10,534 |   |      |   | 17,701 |      |  |   | 27,604 |   |  |      | 39,505 |   |  |   | 55,865 |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Cost of revenues:                                                    |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Cost of product revenue                                              |  |                                       | 1,031  |   |      |   | 1,621  |      |  |   | 1,685  |   |  |      | 2,202  |   |  |   | 2,429  |  
|Cost of services and maintenance revenue                             |  |                                       | 3,128  |   |      |   | 4,901  |      |  |   | 7,930  |   |  |      | 9,146  |   |  |   | 13,639 |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Total cost of revenues                                               |  |                                       | 4,159  |   |      |   | 6,522  |      |  |   | 9,615  |   |  |      | 11,348 |   |  |   | 16,068 |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Gross profit                                                         |  |                                       | 6,375  |   |      |   | 11,179 |      |  |   | 17,989 |   |  |      | 28,157 |   |  |   | 39,797 |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Operating expenses:                                                  |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Selling and marketing                                                |  |                                       | 2,948  |   |      |   | 6,131  |      |  |   | 10,461 |   |  |      | 15,691 |   |  |   | 26,238 |  
|Research and development                                             |  |                                       | 1,168  |   |      |   | 1,881  |      |  |   | 3,295  |   |  |      | 4,680  |   |  |   | 7,113  |  
|General and administrative                                           |  |                                       | 2,760  |   |      |   | 4,185  |      |  |   | 3,894  |   |  |      | 4,923  |   |  |   | 7,840  |  
|Depreciation and amortization                                        |  |                                       | 350    |   |      |   | 613    |      |  |   | 1,158  |   |  |      | 1,357  |   |  |   | 1,823  |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Total operating expenses                                             |  |                                       | 7,226  |   |      |   | 12,810 |      |  |   | 18,808 |   |  |      | 26,651 |   |  |   | 43,014 |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Operating (loss) income                                              |  |                                       | (851   | ) |      |   | (1,631 | )    |  |   | (819   | ) |  |      | 1,506  |   |  |   | (3,217 | )
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Other income and expense:                                            |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Interest income                                                      |  |                                       | 3      |   |      |   | 1      |      |  |   | 3      |   |  |      | 54     |   |  |   | 105    |  
|Interest expense                                                     |  |                                       | (20    | ) |      |   | (72    | )    |  |   | (112   | ) |  |      | (81    | ) |  |   | (91    | )
|Other income, net                                                    |  |                                       | 9      |   |      |   | 12     |      |  |   | 146    |   |  |      | 150    |   |  |   | 173    |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|(Loss) income before income taxes                                    |  |                                       | (859   | ) |      |   | (1,690 | )    |  |   | (782   | ) |  |      | 1,629  |   |  |   | (3,030 | )
|Income tax provision                                                 |  |                                       | 1      |   |      |   | 1      |      |  |   | 10     |   |  |      | 13     |   |  |   | 39     |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Net (loss) income                                                    |  | $                                     | (860   | ) |      | $ | (1,691 | )    |  | $ | (792   | ) |  | $    | 1,616  |   |  | $ | (3,069 | )
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Net (loss) income per share:                                         |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Basic                                                                |  | $                                     | (0.06  | ) |      | $ | (0.10  | )    |  | $ | (0.04  | ) |  | $    | 0.08   |   |  | $ | (0.16  | )
|Diluted                                                              |  | $                                     | (0.06  | ) |      | $ | (0.10  | )    |  | $ | (0.04  | ) |  | $    | 0.08   |   |  | $ | (0.16  | )
|Weighted average number of shares used in per share calculations(1): |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Basic                                                                |  |                                       | 15,419 |   |      |   | 17,327 |      |  |   | 19,431 |   |  |      | 20,412 |   |  |   | 19,530 |  
|Diluted                                                              |  |                                       | 15,419 |   |      |   | 17,327 |      |  |   | 19,431 |   |  |      | 21,023 |   |  |   | 19,530 |  
|Pro forma net (loss) income data(2):                                 |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|(Loss) income before income taxes                                    |  | $                                     | (859   | ) |      | $ | (1,690 | )    |  | $ | (782   | ) |  | $    | 1,629  |   |  | $ | (3,030 | )
|Pro forma provision for income taxes                                 |  |                                       | 1      |   |      |   | 1      |      |  |   | 10     |   |  |      | 343    |   |  |   | 39     |  
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  
|Pro forma net income                                                 |  | $                                     | (860   | ) |      | $ | (1,691 | )    |  | $ | (792   | ) |  | $    | 1,286  |   |  | $ | (3,069 | )
|                                                                     |  |                                       |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |        |  



36



---

##### Table of Contents

|                                           |  |                         |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |       
|------------------------------------------ |  | ----------------------- | ------ | - | ---- | - | ------ | ---- |  | - | ------ | - |  | ---- | ------ | - |  | - | ------
|                                           |  | Year Ended December 31,
|                                           |  | 2002                    |        |   | 2003 |   |        | 2004 |  |   | 2005   |   |  | 2006
|                                           |  | (in thousands)         
|Non-cash Share Based Compensation Data(3): |  |                         |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |       
|Cost of product revenue                    |  | $                       |       |   |      | $ |       |      |  | $ |       |   |  | $    |       |   |  | $ | 2     
|Cost of services and maintenance revenue   |  |                         | 67     |   |      |   | 67     |      |  |   | 36     |   |  |      |       |   |  |   | 232   
|Selling and marketing                      |  |                         |       |   |      |   |       |      |  |   |       |   |  |      |       |   |  |   | 328   
|Research and development                   |  |                         |       |   |      |   |       |      |  |   |       |   |  |      |       |   |  |   | 148   
|General and administrative                 |  |                         | 134    |   |      |   | 134    |      |  |   | 72     |   |  |      |       |   |  |   | 392   
|                                           |  |                         |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |       
|Total non-cash share based compensation    |  | $                       | 201    |   |      | $ | 201    |      |  | $ | 108    |   |  | $    |       |   |  | $ | 1,102 
|                                           |  |                         |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |       
|                                           | 
|                                           |  | Year Ended December 31,
|                                           |  | 2002                    |        |   | 2003 |   |        | 2004 |  |   | 2005   |   |  | 2006
|Balance Sheet Data:                        |  |                         |        |   |      |   |        |      |  |   |        |   |  |      |        |   |  |   |       
|Cash and cash equivalents                  |  | $                       | 365    |   |      | $ | 2,735  |      |  | $ | 2,303  |   |  | $    | 7,556  |   |  | $ | 8,041 
|Total assets                               |  | $                       | 3,050  |   |      | $ | 8,502  |      |  | $ | 11,993 |   |  | $    | 21,526 |   |  | $ | 59,345
|Notes payable and capital leases           |  | $                       | 645    |   |      | $ | 1,520  |      |  | $ | 1,445  |   |  | $    | 733    |   |  | $ | 1,430 
|Deferred revenue                           |  | $                       | 4,455  |   |      | $ | 6,619  |      |  | $ | 9,810  |   |  | $    | 16,319 |   |  | $ | 20,221
|Total stockholders (deficit) equity       |  | $                       | (3,507 | ) |      | $ | (2,747 | )    |  | $ | (3,431 | ) |  | $    | (1,815 | ) |  | $ | 26,689

---

|(1) | See Note 2 to our consolidated financial statements for an explanation of the determination of the number of shares used to compute basic and diluted per share amounts.
|--- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------

|(2) | In October 1998, we elected to be treated for Federal income tax purposes as an S Corporation and were exempt from paying federal income taxes. In addition, from and after the day
we elected or were otherwise treated as an S Corporation for state tax purposes to the day prior to the day our status as an S Corporation was revoked, we paid or are required to pay certain state income taxes at a reduced rate. We filed an election
to revoke our S Corporation status on December 11, 2006. Pro forma net (loss) income data is unaudited and reflects the income tax expense that would have been recorded had we not been exempt from paying income taxes due to our S Corporation
election.
|--- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

|(3) | Non-cash compensation recorded in the years ended December 31, 2002, 2003 and 2004 is related to restricted common shares granted to certain key employees (see Note 10 to the
consolidated financial statements). Non-cash compensation recorded in the year ended December 31, 2006 relates to stock options granted to employees measured under the fair value method (see Note 10 to the consolidated financial statements).
|--- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



|Item 7. | Managements Discussion and Analysis of Financial Condition and Results of Operations
|------- | -------------------------------------------------------------------------------------

The following discussion of our financial condition and results of operations should be read together with the financial statements and related notes
that are included elsewhere in this Annual Report. This discussion may contain forward-looking statements based upon current expectations that involve risks and uncertainties. Our actual results may differ materially from those anticipated in these
forward-looking statements as a result of various factors, including those set forth under Risk Factors or in other parts of this Annual Report.

Overview

We develop and provide the leading software solutions for digital investigations, including EnCase® Enterprise, a network-enabled product primarily for
large corporations and government agencies, and EnCase® Forensic, a desktop-based product primarily for law enforcement agencies. We were incorporated and commenced operations in 1997. From 1997 through 2002, we generated a substantial portion of our revenues from the sale
of our EnCase® Forensic products and related
services. Between 2003 and 2006, after the release of our EnCase® Enterprise products and related services, our revenues were driven by the sales of both our EnCase® Forensic products and our EnCase® Enterprise products and related services.



37



---

##### Table of Contents

We have experienced increases in our revenue as a result of the release of our EnCase® Enterprise products in late 2002, which expanded our
customer base into corporate enterprises and federal government agencies. The release of our eDiscovery Suite in late 2005 has increased our average transaction size, although the number of eDiscovery Suite transactions has been limited. On an
ongoing basis, we anticipate that sales of our EnCase® Enterprise products and related services, in particular our eDiscovery Suite and Information Assurance Suite solutions, will comprise a substantial portion of our future revenues.

Sources of Revenues

Product Revenue

We generate product revenue principally from sales of our EnCase ® Enterprise and EnCase® Forensic products. Substantially all of the EnCase® Enterprise and EnCase® Forensic license agreements that we have entered into are perpetual in license term. In
conjunction with our EnCase® Forensic software, we
also sell our Premium License Support Program product, which is sold on a subscription basis for a term of several years. In addition, we also resell certain Forensic hardware and FastBloc® hardware.

Services and Maintenance Revenue

Services revenue is comprised of revenue from professional services and training. Professional services is comprised of consulting services and implementation services. Consulting services are typically billed on a per hour or per disk
drive basis or are provided under fixed fee arrangements depending on the scope and size of each individual project. Implementation services are generally included with the purchase of a software license. Training services include a broad range of
training course offerings on the general principals of computer forensics and how to use our EnCase® software products. Training services are typically billed on a per person, per class basis.

Maintenance services represent technical support services for our software solutions and include the right to unspecified product upgrades on a when-and-if available basis. Maintenance services are generally included
in the sale of a perpetual license and typically are provided for a period of one year. Upon the expiration of our maintenance contracts, our customers have the right to purchase maintenance contract renewals, which generally cover a period of one
year. We also offer maintenance contract renewal options for up to a three-year period.

Cost of Revenues and Operating Expenses

Cost of Revenues

Cost of
product revenue consists principally of compensation and related overhead expenses for employees engaged in the distribution of our products, and the cost of producing and shipping our software, including the cost of compact discs, packaging and
freight, and our FastBloc® hardware. Cost of
services and maintenance revenue consists of customer support costs, training expenses and professional services expenses, including compensation and related overhead expenses. In addition, the cost of outsourcing certain services work is included
in cost of services. Cost of revenues in 2006 also includes share-based compensation allocable to production and service personnel.

Selling and Marketing

Selling and marketing expenses consist primarily of base compensation and related overhead
expenses for employees engaged in selling and marketing. Selling and marketing expenses also include sales commissions and expenses relating to advertising, brand building, marketing and trade show events (net of amounts received from sponsors and
participants), product management, travel and allocated overhead. Selling and marketing expenses in 2006 also include share-based compensation allocable to selling and marketing personnel.

Although we expense our sales commissions at the time the related sale is invoiced to the client, revenues from our EnCase® Forensic product, Premium License Support Program and consulting, maintenance
and



38



---

##### Table of Contents

implementation are recognized over the relevant performance or license period. Accordingly, we generally experience a delay between increased selling and
marketing expenses and the recognition of a portion of the corresponding revenue.

Research and Development

Research and development expenses consist primarily of compensation and related overhead expenses for research and development personnel, translation
fees, quality assurance and testing. Research and development expenses in 2006 also include share-based compensation allocable to research and development personnel.

General and Administrative

General and administrative expenses consist of compensation and
related overhead expenses for personnel engaged in the accounting, legal, information systems, human resources and other administrative functions. In addition, it includes professional service fees, other corporate expenses and related overhead.
General and administrative expenses also include share-based compensation allocable to general and administrative personnel.

Depreciation and Amortization

Depreciation and amortization expenses consist of depreciation and amortization of our
lease-hold improvements, furniture and computer equipment.

Income Tax Provision

Our income tax provision consists of expenses related to the taxable income incurred based on our tax rate as an S Corporation. We filed an election to
revoke our S Corporation status on December 11, 2006. From and after the revocation of our S Corporation status, we will be treated for federal and state income tax purposes as a C Corporation and, as a result, will be subject to state and
federal corporate income taxes.

Share-Based Compensation

Effective January 1, 2006, we adopted Statement of Financial Accounting Standards (SFAS) No. 123R (SFAS 123R)
Share-Based Payment. Prior to the adoption of SFAS 123R, we used the minimum-value method afforded by the Statement of Financial Accounting Standards (SFAS) No. 123 (SFAS 123) Accounting for Stock-Based
Compensation, for disclosure purposes; therefore, as prescribed by SFAS 123R, we adopted SFAS 123R using the prospective transition method. Accordingly, prior period amounts have not been restated. Under this transition method, compensation
cost for options granted prior to January 1, 2006 that vest after that date will continue to be accounted for based on the grant date intrinsic value of the option estimated in accordance with the provisions of APB 25. Since all of these
options were granted at exercise prices that were equal to the fair market value of the underlying stock on the date of the grant, we will not recognize share-based compensation expense as these options continue to vest. All share-based payments
granted subsequent to January 1, 2006 will be accounted for based on the grant date fair value estimated in accordance with the provisions of SFAS 123R. The fair market value of a share-based payment is estimated on the date of the grant using
the Black-Scholes option pricing model, and is recognized as compensation expense over the vesting period.

Prior to January 1, 2006,
we accounted for the stock options granted under our 2004 Equity Incentive Plan by applying the intrinsic value-based method of accounting prescribed by Accounting Principles Board Opinion No. 25 (APB 25), Accounting for Stock
Issued to Employees. Under this method, compensation expense is generally recorded only if the fair value of the underlying stock exceeded the exercise price on the date of grant. We adopted the disclosure-only requirement of the SFAS123 and
SFAS No. 148 (SFAS 148), Accounting for Stock-Based CompensationTransition and Disclosurean Amendment of FASB Statement No. 123. These



39



---

##### Table of Contents

statements established accounting and disclosure requirements using a fair value-based method of accounting for stock-based employee compensation plans. As
allowed by SFAS 123 and SFAS 148, we elected to continue to apply the intrinsic value-based method described above for stock options granted prior to January 1, 2006. Accordingly, no share-based compensation for stock options is recorded in the
accompanying financial statements prior to January 1, 2006, as the fair-value of the underlying stock did not exceed the exercise price of the options at the date of grant.

As of December 31, 2006, there was $7.0 million of total unrecognized compensation cost related to non-vested stock-based compensation that is
expected to be recognized over a weighted-average period of 3.78 years for grants subsequent to January 1, 2006.

On May 2, 2006,
our founding stockholders contributed 2,062,000 common shares to us. The contribution was made as a result of a commitment by the founding stockholders, upon establishment of the 2004 Equity Incentive Plan, to fund the common shares underlying the
initial 2,062,000 option grants. Upon receipt of the contribution, we retired the common shares. The contribution and related retirement is reflected as donated capital, retired in the consolidated statement of stockholders equity.

Factors Affecting Our Results of Operations

There
are a number of trends that may affect our business and our industry. Some of these trends or other factors include:



| |  |  | Legislative and Regulatory Developments. Our digital investigation solutions allow law enforcement agencies, government organizations and corporations to conduct
investigations within the legal and regulatory framework. Historically, the implementation of new laws and regulations surrounding digital investigations has helped create demand for our products. Future changes in applicable laws or regulations
could enhance or detract from the desirability of our products.
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Information Technology Budgets. Deployment of our solutions may require a substantial capital expenditure by our clients. Budgets for information technology-related
capital expenditures at corporations and all levels of government organizations are typically cyclical in nature, with generally higher budgets in times of improving economic conditions and lower budgets in times of economic slowdowns.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Law Enforcement Agency Budgets. We sell our EnCase® Forensic products primarily to law enforcement agencies. Because of the limited nature of law enforcement budgets, funds are typically initially
allocated toward solving issues perceived to be the most pressing. Sales of our products could be impacted by changes in the budgets of law enforcement agencies or in the relative priority assigned to digital law enforcement investigations.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Number of Hacking Incidents and Spread of Malicious Software. The increasing sophistication of hacking attacks on government and private networks and the global
spread of malicious software, such as viruses, worms and rootkits, have increased the focus of corporations and large government organizations on digital investigations and other aspects of network security, which has, in turn, increased demand for
our products. Future changes in the number and severity of such attacks or the spread of malicious software could have an effect on the demand for our products.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Seasonality in Revenues. We experience seasonality in our revenues, with the third and fourth quarters typically having the highest revenues for the year. We
believe that this seasonality results primarily from our customers budgeting cycles. The federal government budget year ends in the third calendar quarter of the year and a majority of corporate budget years end in the fourth calendar quarter
of the year. In addition, our customers also tend to make software purchases near the end of a particular quarter, which tends to make our revenues for a particular period unpredictable for a significant portion of the period in question until
software purchase decisions have been made and license agreements have been entered into. We expect that this seasonality within a particular year and unpredictability within a particular quarterly period will continue for the foreseeable future.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



40



---

##### Table of Contents

Prior S Corporation Status

From our incorporation through September 1998, we were treated as a C Corporation under Subchapter C of the Code. In October 1998, we elected to be treated for federal income tax purposes as an S
Corporation under Subchapter S of the Code. In addition, we also elected or may have been otherwise treated as an S Corporation for certain state tax purposes. We filed an election to revoke our S Corporation status on December 11, 2006.
From and after the termination of our S Corporation status, we have been treated for federal and state income tax purposes as a C Corporation under Subchapter C of the Code and, as a result, we are subject to state and federal corporate income
taxes.

We have entered into a tax matters agreement with our existing pre-IPO S Corporate stockholders to which we have agreed, among
other things, to indemnify and hold harmless our existing pre-IPO S Corporation stockholders in certain circumstances for increases in their tax liability for the periods during which we were an S Corporation.

Application of Critical Accounting Policies

Our
discussion and analysis of our financial condition and results of operations are based upon our financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States of America. The
preparation of these financial statements requires us to make estimates and judgments that affect the reported amounts of assets, liabilities, revenues and expenses, and related disclosure of contingent assets and liabilities. On an on-going basis,
we evaluate these estimates, including those related to percentage-of- completion, bad debts, inventories, investments, income taxes, commitments, contingencies and litigation. We base our estimates on historical experience and on various other
assumptions that are believed to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets and liabilities that are not readily apparent from other sources. Actual results may
differ from these estimates under different assumptions or conditions.

We consider the following accounting policies to be both those most
important to the portrayal of our results of operations and financial condition and those that require the most subjective judgment:



| |  |  | revenue recognition;
| | - |  | --------------------



| |  |  | commitments and contingencies;
| | - |  | ------------------------------



| |  |  | allowance for doubtful accounts; and
| | - |  | ------------------------------------



| |  |  | accounting for taxes
| | - |  | --------------------

Revenue
Recognition

We apply the provisions of SOP 97-2 and related interpretations. For arrangements that contain a non-software
deliverable such as hardware, we apply the provisions of Emerging Issues Task Force (EITF) Issue No. 03-05 Applicability of AICPA Statement of Position 97-2 to Non-Software Deliverables in an Arrangement Containing
More-Than-Incidental Software and recognize revenue when all other revenue recognition criteria are met. While these statements govern the basis for revenue recognition, significant judgment and the use of estimates are required in connection
with the allocation of revenue between product revenue and services and maintenance revenue, as well as the amount of deferred revenue to be recognized in each accounting period.

Product Revenue. The timing of product revenue recognition is dependent on the nature of the product sold. Product arrangements comprising
multiple deliverables including software and hardware are generally categorized into one of the following:



| |  |  | EnCase® Enterprise Edition. Revenue associated with these arrangements, exclusive of amounts allocated to maintenance and other undelivered elements for which we have vendor-specific objective
evidence (VSOE) of fair value, is recognized upon delivery, provided that all other criteria for revenue recognition have been met.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



41



---

##### Table of Contents

| |  |  | EnCase® Forensic Edition Solutions. Prior to 2005, the entire arrangement fee from governmental agencies and corporate customers was recognized as revenue ratably over the longer of the
contractual maintenance period (12 months) or the implied maintenance period (12-25 months) because VSOE of fair value of the maintenance element did not exist. Beginning in early 2005, based on substantive renewal provisions, we established VSOE of
the fair value of the maintenance element for solutions sold to corporate customers. Accordingly, beginning with the release of EnCase® Forensic Edition Version 5, revenue from corporate customers, exclusive of amounts allocated to maintenance, for which we have VSOE of fair value, is
recognized upon delivery, provided that all other criteria for revenue recognition have been met. We allocate EnCase® Forensic Edition revenue to government customers, which continues to be recognized ratably, between product and services and maintenance based on our
estimated fair value of the services and maintenance portion of the EnCase® Forensic Edition revenue.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Premium License Support Program Solutions. The Premium License Support Program is a subscription arrangement entitling the customer to receive unspecified future
products and post-contract customer support for a period of several years. Revenue resulting from Premium License Support Program arrangements is recognized ratably over the contractual period beginning with the delivery of the first product.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Hardware. Revenue associated with the sale of FastBloc® hardware and other hardware is recognized upon shipment to the customer, provided (i) persuasive evidence of an arrangement exists,
(ii) title and risk of ownership has passed to the buyer, (iii) the fee is fixed or determinable and (iv) collection is deemed probable.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Services and Maintenance Revenue. Services and maintenance revenue consists of professional services, training, and maintenance. Revenue from such services is recognized as the services are provided.

Revenue related to technical support and software updates on a when-and-if available basis, which we refer to as maintenance revenue, is
also included in services and maintenance revenue. We recognize all maintenance revenue ratably over the applicable maintenance period. We determine the amount of maintenance revenue to be deferred through reference to substantive maintenance
renewal provisions contained in the arrangement. We consider substantive maintenance provisions to be provisions where the cost of the maintenance renewal, stated in the contract with our customer as a percentage of the product fee, is comparable to
the normal pricing for maintenance only renewals.

Revenue Recognition Criteria. We recognize revenue when persuasive evidence of an
arrangement exists, the element has been delivered, the fee is fixed or determinable and collection of the resulting receivable is probable. A discussion about these revenue recognition criteria and their applicability to our transactions follows:



| |  |  | Persuasive evidence of an arrangement. We either enter into contracts or receive written purchase orders issued by the customer that legally bind us and the
customer as evidence of an arrangement.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Product delivery. We deem delivery of product to have occurred when the title and risk of ownership has passed to the buyer. Services revenue is recognized as
services are delivered.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Fixed or determinable fee. We consider the fee to be fixed or determinable if the fee is not subject to refund or adjustment and the payment terms are within its
normal established practices. If the fee is not fixed or determinable, we recognize the revenue as amounts become due and payable, provided all other revenue recognition criteria have been met.
| | - |  | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Collection is deemed probable. We conduct a credit review for all significant transactions at the time of the arrangement to determine the credit-worthiness of the
customer. Collection is deemed probable if we have a reasonable basis to expect that the customer will pay amounts under the arrangement as payments become due.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



42



---

##### Table of Contents

Commitments and Contingencies

We periodically evaluate all pending or threatened contingencies and commitments, if any, that are reasonably likely to have a material adverse effect on
our operations or financial position. We assess the probability of an adverse outcome and determine if it is remote, reasonably possible or probable as defined in accordance with the provisions of SFAS No. 5, Accounting for
Contingencies. If information available prior to the issuance of our financial statements indicates that it is probable that an asset had been impaired or a liability had been incurred at the date of our financial statements, and the amount of
the loss, or the range of probable loss can be reasonably estimated, then such loss is accrued and charged to operations. If no accrual is made for a loss contingency because one or both of the conditions pursuant to SFAS No. 5 are not met, but
the probability of an adverse outcome is at least reasonably possible, we will disclose the nature of the contingency, if material, and provide an estimate of the possible loss or range of loss, or state that such an estimate cannot be made.

Allowances for Doubtful Accounts

We maintain an allowance for doubtful accounts for estimated losses resulting from the inability of our customers to make required payments. The allowance is established through a provision for bad debt expense. We
determine the adequacy of this allowance by evaluating individual customer accounts receivable, through consideration of the customers financial condition, credit history and current economic conditions. If the financial condition of our
customers were to deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

Accounting for Taxes

In preparing our consolidated financial statements, we estimate our income tax liability in
each of the jurisdictions in which we operate by estimating our actual current tax exposure and assessing temporary differences resulting from differing treatment of items for tax and financial statement purposes. As a result of the termination of
our S Corporation status, we will record deferred tax assets, which we expect to be fully reserved. Managements judgment will be required in assessing the realizability of this and future deferred tax assets. In performing these assessments,
we consider whether it is more likely than not that some portion or all of the deferred tax assets will not be realized. The ultimate realization of deferred tax assets is dependent upon the generation of future taxable income during the periods in
which those temporary differences become deductible. We consider the scheduled reversal of deferred tax liabilities, projected future taxable income, and tax planning strategies in making this assessment. In the event that actual results differ from
our estimates or we adjust our estimates in future periods, we may need to make or adjust valuation allowances with respect to our deferred tax assets. Our income tax provision is based on calculations and assumptions that may be subject to
examination by the Internal Revenue Service and other authorities. Should the actual results differ from our estimates, we would have to adjust the income tax provision in the period in which the facts that give rise to the revision become known.
Tax law and rate changes are reflected in the income tax provision in the period in which such changes are enacted.

Results of Operations

The following table sets forth selected statements of operations data for each of the periods indicated expressed as a percentage of
total revenues:



|                                         |  |                        |   |  |       |   |  |       |  
|---------------------------------------- |  | ---------------------- | - |  | ----- | - |  | ----- | -
|                                         |  | Year Ended December 31 |  
|                                         |  | 2004                   |   |  | 2005  |   |  | 2006  |  
|Revenues:                                |  |                        |   |  |       |   |  |       |  
|Product revenue                          |  | 57.3                   | % |  | 58.6  | % |  | 58.3  | %
|Services and maintenance revenue         |  | 42.7                   |   |  | 41.4  |   |  | 41.7  |  
|                                         |  |                        |   |  |       |   |  |       |  
|Total revenues                           |  | 100.0                  |   |  | 100.0 |   |  | 100.0 |  
|                                         |  |                        |   |  |       |   |  |       |  
|Cost of revenues:                        |  |                        |   |  |       |   |  |       |  
|Cost of product revenue                  |  | 6.2                    |   |  | 5.6   |   |  | 4.3   |  
|Cost of services and maintenance revenue |  | 28.7                   |   |  | 23.1  |   |  | 24.4  |  
|Total cost of revenues                   |  | 34.9                   |   |  | 28.7  |   |  | 28.7  |  
|                                         |  |                        |   |  |       |   |  |       |  
|Gross profit                             |  | 65.1                   |   |  | 71.3  |   |  | 71.3  |  
|                                         |  |                        |   |  |       |   |  |       |  



43



---

##### Table of Contents

|                                  |  |                        |    |  |      |   |  |      |   
|--------------------------------- |  | ---------------------- | -- |  | ---- | - |  | ---- | --
|                                  |  | Year Ended December 31 |   
|                                  |  | 2004                   |    |  | 2005 |   |  | 2006 |   
|Operating expenses:               |  |                        |    |  |      |   |  |      |   
|Selling and marketing             |  | 37.9                   |    |  | 39.8 |   |  | 47.0 |   
|Research and development          |  | 11.9                   |    |  | 11.8 |   |  | 12.7 |   
|General and administrative        |  | 14.1                   |    |  | 12.5 |   |  | 14.0 |   
|Depreciation and amortization     |  | 4.2                    |    |  | 3.4  |   |  | 3.3  |   
|                                  |  |                        |    |  |      |   |  |      |   
|Total operating expenses          |  | 68.1                   |    |  | 67.5 |   |  | 77.0 |   
|                                  |  |                        |    |  |      |   |  |      |   
|Operating (loss) income           |  | (3.0                   | )  |  | 3.8  |   |  | (5.7 | ) 
|                                  |  |                        |    |  |      |   |  |      |   
|Other income and expense:         |  |                        |    |  |      |   |  |      |   
|Interest income                   |  | 0.0                    |    |  | 0.1  |   |  | 0.2  |   
|Interest expense                  |  | (0.4                   | )  |  | (0.2 | ) |  | (0.2 | ) 
|Other income, net                 |  | 0.5                    |    |  | 0.4  |   |  | 0.3  |   
|                                  |  |                        |    |  |      |   |  |      |   
|(Loss) income before income taxes |  | (2.9                   | )  |  | 4.1  |   |  | (5.4 | ) 
|Income tax provision              |  | 0.0                    |    |  | 0.0  |   |  | 0.1  |   
|                                  |  |                        |    |  |      |   |  |      |   
|Net (loss) income                 |  | (2.9                   | )% |  | 4.1  | % |  | (5.5 | )%
|                                  |  |                        |    |  |      |   |  |      |   

Comparison of Results for the Years Ended December 31, 2006 and 2005

Revenues

Revenues were $55.9
million for the year ended December 31, 2006 compared to $39.5 million for the year ended December 31, 2005, an increase of $16.4 million or 41.4%.

Product revenue was $32.6 million for the year ended December 31, 2006 compared to $23.1 million for the year ended December 31, 2005, an increase of $9.4 million or 40.7%. Revenues generated from
EnCase® Enterprise increased to $19.7 million in
2006 from $11.9 million in 2005 and was the primary reason for the increase in our product revenues. We were able to generate these increases as a result of increased selling and marketing efforts, and a significant increase in head count of
commissioned sales personnel. In addition, in late 2005 we introduced our eDiscovery Suite, and in mid 2006 our Information Assurance Suite, which have increased our average transaction size. During fiscal year 2006, forty-nine suites were sold as
compared to two during fiscal year 2005. The first two quarters of each fiscal year is typically our period of lowest product sales due to the seasonal budgetary cycles of our customers. The third quarter is typically the strongest sales quarter to
our federal government customers. Whereas the fourth quarter is typically our strongest sales quarter to our corporate customers.

Services
and maintenance revenues were $23.3 million for the year ended December 31, 2006 compared to $16.4 million for the year ended December 31, 2005, an increase of $6.9 million or 42.4%. Services revenue grew by $3.7 million as a result of
increased consulting revenue of $2.8 million and increased software implementation revenue of $0.9 million. In addition, there was increased training revenue of $0.3 million. Our consulting revenue grew as a result of increased demand for our
professional digitial investigative services. In addition, maintenance revenue grew by $2.9 million as a result of increased new product sales and increases in maintenance renewal rates.

Cost of Revenues

Cost of
revenues was $16.1 million for the year ended December 31, 2006 compared to $11.3 million for the year ended December 31, 2005, an increase of $4.7 million or 41.6%. Gross profit as a percentage of revenues remained consistent at 71.3% and
71.3% for the years ended December 31, 2006 and 2005, respectively.

Cost of product revenue was $2.4 million for the year ended
December 31, 2006 compared to $2.2 million for the year ended December 31, 2005, an increase of $0.2 million or 10.3%. Product gross margin was 92.5%



44



---

##### Table of Contents

and 90.5%, respectively, for the years ended December 31, 2006 and 2005. Product gross margin increased as a result of increased sales of our
EnCase® Enterprise product, which is a higher
margin product than our EnCase® Forensic and
hardware products, offset by increased costs associated with the release of EnCase Version 6.

Cost of services and maintenance revenue was
$13.6 million for the year ended December 31, 2006 compared to $9.1 million for the year ended December 31, 2005, an increase of $4.5 million or 49.1%. An increase in compensation expense of $3.0 million and an increase in travel related
expenses of $0.5 million contributed to the increase in cost of services and maintenance revenue. In addition, facilities costs and other overhead costs increased by $0.5 million. Services and maintenance gross margin was 41.5% for the year ended
December 31, 2006 compared to 44.1% for the year ended December 31, 2005. The decrease in services and maintenance gross margin was due to the hiring of new professional services personnel during 2006 to meet the increase in demand for our
services and services related costs associated with the release of Encase Version 6.

Selling and Marketing

Selling and marketing expenses increased to $26.2 million for the year ended December 31, 2006 compared to $15.7 million for the year ended
December 31, 2005, an increase of $10.5 million or 67.2%. The increase was primarily attributable to an increase in selling and marketing compensation expense for marketing personnel and commissioned sales representatives of $6.4 million,
combined with an increase in travel expenses of $1.0 million and a $1.0 million increase in costs associated with our Computer and Enterprise Investigations Conference (CEIC®) and other tradeshows. General marketing promotions and activities also increased $0.4 million In addition,
facilities costs and other overhead costs associated with selling and marketing activities increased by $0.8 million. Selling and marketing head count increased from 90 to 151 at the respective period ends. Selling and marketing expenses as a
percentage of revenue increased to 47.0% for the year ended December 31, 2006 from 39.8% for the year ended December 31, 2005.

Research and Development

Research and development expenses increased to $7.1 million for the year ended
December 31, 2006 compared to $4.7 million for the year ended December 31, 2005, an increase of $2.4 million or 52.0%. Research and development compensation expense increased $2.1 million due to an increase in research and development
personnel from 32 to 60 at the respective period ends to develop new product offerings, continue developing existing products and improve quality assurance. Research and development expenses as a percentage of revenue for the year ended
December 31, 2006 increased to 12.7% compared to 11.8% for the year ended December 31, 2005.

General and Administrative

General and administrative expenses increased to $7.8 million for the year ended December 31, 2006 compared to $4.9 million
for the year ended December 31, 2005, an increase of $2.9 million or 59.3%. An increase in compensation and temporary help expense of $2.5 million and an increase in outside professional fees relating to our preparation to be a public company
of $0.5 million contributed to the increase in general and administrative expenses. General and administrative expenses as a percentage of revenue increased to 14.0% for the year ended December 31, 2006 compared to 12.5% for the year ended
December 31, 2005.

Depreciation and Amortization

Depreciation and amortization expense increased to $1.8 million for the year ended December 31, 2006 compared to $1.4 million for the year ended
December 31, 2005, an increase of $0.5 million. The primary reason for the increase in depreciation and amortization expense is due to the purchase of computer equipment for our new employees. Furthermore, as we continue to open offices around
the United States and abroad, we are investing in leasehold improvements, networks and phone equipment to allow these remote offices to safely access our corporate network. In 2006, we invested in approximately $5.7 million in capital equipment and
leasehold improvements.



45



---

##### Table of Contents

Interest Income and Interest Expense

Interest income increased to $105,000 for the year ended December 31, 2006 compared to $54,000 for the year ended December 31, 2005. The
increase in interest income is due to the proceeds received from the initial public offering in December 2006. As our initial public offering was in December, we expect interest income to increase significantly as the result of the proceeds being
invested for the full duration of the future periods. There was no significant change in interest expense during 2006 as compared to 2005.

Income Tax Provision

The Provision for Income Taxes increased to $39,000 for the year ended December 31, 2006
compared to $13,000 for the year ended December 31, 2005. The increase was primarily due to state taxes.

Comparison of Results for the Years Ended
December 31, 2005 and 2004

Revenues

Revenues were $39.5 million for the year ended December 31, 2005 compared to $27.6 million for the year ended December 31, 2004, an increase of $11.9 million or 43.1%.

Product revenue was $23.1 million for the year ended December 31, 2005 compared to $15.8 million for the year ended December 31, 2004, an
increase of $7.3 million or 46.3%. The increase in product revenue was a result of continued growth of our EnCase® Enterprise product, including introduction of our eDiscovery Suite in the fourth quarter of 2005 and increased selling and marketing efforts, which included significant increased head
count of commissioned sales personnel. In addition, during the year ended December 31, 2004, we recognized revenues related to our EnCase® Forensic product ratably over the maintenance period. Starting in early 2005, we recognized product revenue related to the sale of EnCase® Forensic to commercial customers upon delivery. This
resulted in additional product revenue of $1.2 million being recognized in the year ended December 31, 2005, that would otherwise have been recognized in subsequent periods.

Services and maintenance revenue was $16.4 million for the year ended December 31, 2005 compared to $11.8 million for the year ended
December 31, 2004, an increase of $4.6 million or 38.8%. Services revenue grew as a result of increases to the number, size and complexity of consulting engagements, which resulted in an increase of $1.7 million in consulting revenue, an
increase in software implementation revenues of $0.2 million and an increase in training revenue of $0.6 million. In addition, maintenance revenue grew $1.9 million as a result of increased product sales and increases in maintenance renewal rates.

Cost of Revenues

Cost of revenues was $11.3 million for the year ended December 31, 2005 compared to $9.6 million for the year ended December 31, 2004, an increase of $1.7 million or 18.0%. Gross profit as a percentage of revenues was 71.3% and
65.2% for the year ended December 31, 2005 and 2004, respectively.

Cost of product revenue was $2.2 million for the year ended
December 31, 2005 compared to $1.7 million for the year ended December 31, 2004, an increase of $0.5 million or 30.7%. The most significant portion of this increase was $0.2 million as a result of increased shipping and customs charges.
Product gross margin was 90.5% and 89.3%, respectively, for the year ended December 31, 2005 and 2004. Product gross margin increased as a result of spreading slightly increased distribution costs over a greater revenue base, as well as
increased sales of our EnCase® Enterprise product,
which is a higher margin product than our EnCase®
Forensic product and hardware.

Cost of services and maintenance revenue was $9.1 million for the year ended December 31, 2005
compared to $7.9 million for the year ended December 31, 2004, an increase of $1.2 million or 15.3%. Increases in compensation expense of $0.8 million and a contract settlement of $0.3 million contributed to the increase in cost of services and
maintenance revenues. Services and maintenance gross margin was 44.1% for the year ended



46



---

##### Table of Contents

December 31, 2005 compared to 32.8% for the year ended December 31, 2004. The increase in services and maintenance gross margin was due to
increased utilization of salaried personnel and higher utilization rates in our Professional Services Division. In addition, our Professional Services Division reached profitability in 2005, following its launch in 2003.

Selling and Marketing

Selling
and marketing expenses increased to $15.7 million for the year ended December 31, 2005 compared to $10.5 million for the year ended December 31, 2004, an increase of $5.2 million or 50.0%. The increase was primarily attributable to an
increase in selling and marketing compensation expense of $3.6 million, combined with an increase in conference, promotion, collateral and tradeshow expenses of $0.4 million and an increase in travel expenses of $0.5 million. Selling and marketing
head count increased from 54 to 90 at the respective period ends. Higher selling and marketing commission expense was driven by accelerated sales of our EnCase® Enterprise product, which carries a higher commission than our EnCase® Forensic product. Selling and marketing expenses as a percentage of revenue increased
to 39.7% for the year ended December 31, 2005 from 37.9% for the year ended December 31, 2004, due to the hiring of new selling and marketing personnel, who typically require several quarters to generate corresponding increases in revenue.

Research and Development

Research and development expenses increased to $4.7 million for the year ended December 31, 2005 compared to $3.3 million for the year ended December 31, 2004, an increase of $1.4 million or 42.0%. Research
and development compensation expense increased $0.8 million as a result of an increase in research and development personnel from 22 to 32 at the respective period ends to meet additional product development demands and quality assurance
requirements. In addition, the licensing of third-party intellectual property to be integrated into our products resulted in an increase of $0.4 million in research and development expenses. Research and development expenses as a percentage of
revenue decreased to 11.8% for the year ended December 31, 2005 compared to 11.9% for the year ended December 31, 2004 as result of revenues outpacing our research and development hiring.

General and Administrative

General and administrative expenses increased to $4.9 million for the year ended December 31, 2005 compared to $3.9 million for the year ended December 31, 2004, an increase of $1.0 million or 26.4%. The increase was primarily
attributable to an increase in outside professional fees of $0.6 million, as well as increased employee compensation and temporary help of $0.2 million. In addition, in the year ended December 31, 2005 we recorded a $0.5 million legal
contingency accrual as a result of the security breach of our electronic records in December 2005 and the resulting FTC inquiry. General and administrative expenses as a percentage of revenue decreased to 12.5% for the year ended December 31,
2005 compared to 14.1% for the year ended December 31, 2004 as result of revenues outpacing our general and administrative hiring.

Depreciation and Amortization

Depreciation and amortization expense increased to $1.4 million for the year ended
December 31, 2006 compared to $1.2 million for the year ended December 31, 2005, an increase of $0.2 million. The increase was not material.

Liquidity and Capital Resources

Since inception, we have largely financed our operations from our cash flow from
operations. In December 2006, we issued and sold 3,250,000 primary shares of our common stock at $11.50 per share, for net proceeds of $34.8 million in our initial public offering which was partially offset cash paid for offering expenses of $3.8
million. As of December 31, 2006, we had $8.0 million in cash and cash equivalents. In addition, we had $24.7 million in short term marketable debt securities.



47



---

##### Table of Contents

We derive cash from operations primarily from cash collected upon the sale of our products and related
services. Net cash used in operating activities was $2.8 million for the year ended December 31, 2006 compared with net cash provided by operations of $7.5 million in the year ended December 31, 2005. The decrease in cash provided resulted
from increased payroll and related costs in the year ended December 31, 2006 from the comparable period in the prior year associated with additional sales, marketing and development personnel to market our existing products and develop new
solutions. Net cash provided by operating activities was $1.2 million in the year ended December 31, 2004. The increase in cash generated by operations in the year ended December 31, 2005 principally reflects an increase in cash collected
from customers due to new offerings, including our Premium License Support Program offering in late 2004 as well as an increase in cash collections from sale of our EnCase® Enterprise product.

Net cash used in investing activities was $27.0 million, $1.0 million and $0.9 million in the years ended December 31, 2006, 2005 and 2004, respectively. The primary reason for the increase in cash used during
2006 was the purchase of marketable debt securities for which there was no corresponding event in either 2005 or 2004. Other investing activities for all periods consisted of capital expenditures, which consisted primarily of leasehold improvements
and office and computer equipment for all of our departments.

Net cash provided by (used in) financing activities was $30.4 million,
($1.3) million and ($0.7) million in the years ended December 31, 2006, 2005 and 2004, respectively. During the year ended December 31, 2006 we received aggregate net proceeds from initial public offering of $34.8 million. In each of the
periods, cash used in financing activities largely consisted of borrowing and payments against our line of credit, shareholder loans and capital leases. In the year ended December 31, 2006, we paid a $1.7 million distribution to our
shareholders to cover S Corporation taxable earnings, which was partially offset by stock option exercise proceeds of $1.7 million. Furthermore, in fiscal 2006 we paid $3.8 million for services provided related to our initial public offering.

We maintain a $3.0 million line of credit with a bank. This line of credit terminates on October 31, 2007. At December 31, 2006,
there were no amounts outstanding against this line. This line requires we maintain certain financial covenants. As of December 31, 2006, we were in violation of certain financial covenants contained in our line of credit, which included a
requirement to maintain a minimum of $1.0 million of earnings before interest, taxes, depreciation and amortization at the end of each fiscal quarter (calculated using the current quarter just ended and the preceding three fiscal quarters), and a
minimum effective tangible net worth at all times equal to or greater than 75% of the net proceeds from the sale of any of our equity interests plus 50% of our annual net income. Minimum effective tangible net worth is defined as our stated net
worth plus our subordinated debt and less our intangible assets. We have obtained a waiver of these violations. On January 10, 2007, we entered into fifth amendment to the line of credit which removed certain financial covenants. On
February 16, 2007, we obtained a waiver of all covenant violations as of December 31, 2006 from the bank.

During the year ended
December 31, 2004, Shawn McCreight, our Founder, Chairman and Chief Technology Officer, made loans to us on an unsecured basis, which obligations bore interest at a rate equal to 5% per annum on the unpaid principal balance and were due in
full on December 31, 2004. We borrowed the funds from Mr. McCreight in lieu of drawing down funds on our then-existing working capital line of credit with our former bank. The highest loan balance that was owed to Mr. McCreight during
this period was approximately $200,000. All amounts loaned by Mr. McCreight to us and related interest thereon were repaid in full in January 2004 and no further amounts are owed to him.

We currently have no material cash commitments, except our normal recurring trade payables, expense accruals and leases, all of which are currently
expected to be funded through existing working capital and future cash flows from operations.

We filed an election to revoke our S
Corporation status election on December 11, 2006. Our S Corporation status is revoked, and we are treated for federal and state income tax purposes as a C Corporation and, as a result, will be subject to state and federal corporate income
taxes.



48



---

##### Table of Contents

At December 31, 2006, our outstanding contractual cash commitments were limited to our
non-cancelable lease obligations, primarily relating to real estate, as follows:



|                                           |  |                        |        |                 |   |          |  |          |       |                  |   |       |  |   |      
|------------------------------------------ |  | ---------------------- | ------ | --------------- | - | -------- |  | -------- | ----- | ---------------- | - | ----- |  | - | -----
|                                           |  | Payments Due by Period
|                                           |  | Total                  |        | Less than1 Year |   | 1-3Years |  | 3-5Years |       | More than5 Years
|                                           |  | (in thousands)        
|Capital lease obligations                  |  | $                      | 1,562  |                 | $ | 942      |  | $        | 616   |                  | $ | 4     |  | $ |     
|Non-cancelable operating lease obligations |  | $                      | 21,005 |                 | $ | 2,840    |  | $        | 8,729 |                  | $ | 7,988 |  | $ | 1,448

We believe that our existing cash and cash equivalents balances, cash provided by operating
activities, our current borrowing arrangements will be sufficient to meet our working capital, capital expenditure and other cash requirement needs over at least the next 12 months. Our future capital requirements will depend on many factors,
including our rate of revenue growth, the expansion of our selling and marketing activities, the timing and extent of research and development spending to support product development and enhancement efforts, costs associated with expansion into new
territories or markets, the timing of the introduction of new products and services and the enhancement of existing products and the continuing market acceptance of our products and services. To the extent that our short term investments and
existing cash, the availability under our line of credit and cash from operations, are insufficient to fund our future activities and planned growth, we may need to raise additional funds through public or private equity or debt financings. Although
we are currently not a party to any agreement or letter of intent with respect to potential investments in, or acquisitions of, complementary businesses, products or technologies, we may enter into these types of arrangements in the future, which
could also require us to seek additional debt or equity financing. Additional funds may not be available on terms favorable to us or at all. Furthermore, although we cannot accurately anticipate the effect of inflation or foreign exchange markets on
our operations, we do not believe these external economic forces have had, or are likely in the foreseeable future to have, a material impact on our results of operations.

At December 31, 2006, we did not have any relationships with unconsolidated entities or financial partnerships, such as entities often referred to
as structured finance, special-purpose, or variable interest entities, which would have been established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes. In addition, we did not engage
in trading activities involving non-exchange traded contracts. As a result, we are not exposed to any financing, liquidity, market or credit risks that could arise if we had engaged in such relationships. We do not have material relationships and
transactions with persons or entities that derive benefits from their non-independent relationship with us or our related parties except as disclosed in this prospectus.

Recent Accounting Pronouncements

In February 2006, the FASB issued SFAS No. 155,
Accounting for Certain Hybrid Financial Instrumentsan amendment of FASB Statements No. 133 and 140 (SFAS 155), to simplify and make more consistent the accounting for certain financial instruments. Specifically,
SFAS 155 amends SFAS No. 133, Accounting for Derivative Instruments and Hedging Activities, to permit fair value remeasurement for any hybrid financial instrument with an embedded derivative that otherwise would require bifurcation,
provided that the whole instrument is accounted for on a fair value basis. SFAS 155 amends SFAS No. 140, Accounting for the Impairment or Disposal of Long-Lived Assets, to allow a qualifying special-purpose entity to hold a
derivative financial instrument that pertains to a beneficial interest other than another derivative financial instrument. SFAS 155 applies to all financial instruments acquired or issued after the beginning of an entitys first fiscal year
that begins after September 15, 2006, with earlier application allowed. We do not expect the adoption of SFAS 155 to have a significant impact on our consolidated results of operations or our financial position.

In June 2006, the FASB issued FASB Interpretation No. 48, Accounting for Uncertainty in Income Taxesan interpretation of FASB Statement
No. 109 (FIN 48). The interpretation clarifies the accounting for uncertainty in income taxes recognized in a companys financial statements in accordance with SFAS No. 109,



49



---

##### Table of Contents

Accounting for Income Taxes. Specifically, the pronouncement prescribes a recognition threshold and a measurement attribute for the financial
statement recognition and measurement of a tax position taken or expected to be taken in a tax return. The interpretation also provides guidance on the related derecognition, classification, interest and penalties, accounting for interim periods,
disclosure and transition of uncertain tax positions. This interpretation is effective for fiscal years beginning after December 15, 2006. The Company has not yet completed its evaluation of the impact of FIN 48 on its consolidated financial
statements. The Company does, however, expect to record a cumulative effect adjustment to its 2007 balance of beginning accumulated deficit, and that adjustment may be material.

In September 2006, the FASB issued SFAS No. 157, Fair Value Measurements (SFAS 157). SFAS 157 does not require new fair
value measurements but rather defines fair value, establishes a framework for measuring fair value and expands disclosure of fair value measurements. SFAS 157 is effective for fiscal years beginning after November 15, 2007 and interim periods
within those fiscal years. We do not expect SFAS 157 to have a material impact on our consolidated financial position and results of operations.

In February 2007, the FASB issued SFAS No. 159, The Fair Value Option for Financial Assets and LiabilitiesIncluding an amendment of FASB Statement No. 115 (SFAS 159).SFAS 159 permits entities
to choose to measure certain financial assets and liabilities at fair value (the fair value option). Unrealized gains and losses, arising subsequent to adoption, are reported in earnings. SFAS 159 is effective for fiscal years beginning
after November 15, 2007. The Company is required to adopt SFAS 159 in the first quarter of 2008. The Company is currently assessing the impact of SFAS 159 on its consolidated financial statements.



|Item 7A. | Quantitative and Qualitative Disclosure about Market Risk
|-------- | ---------------------------------------------------------

Although we currently bill for our products and services mostly in U.S. dollars, our financial results could be affected by factors such as changes in foreign currency rates or weak economic conditions in foreign markets. A strengthening of
the dollar could make our products and services less competitive in foreign markets and therefore could reduce our revenues. We are billed by and pay substantially all of our vendors in U.S. dollars. In the future, an increased portion of our
revenues and costs may be denominated in foreign currencies. To date, exchange rate fluctuations have had little impact on our operating results. We do not enter into derivative instrument transactions for trading or speculative purposes.

Fixed income securities are subject to interest rate risk. The fair value of our investment portfolio would not be significantly impacted
by either a 100 basis point increase or decrease in interest rates due mainly to the short-term nature of the major portion of our investment portfolio. The portfolio is invested in United States Treasury Bills.



|Item 8. | Financial Statements and Supplementary Data
|------- | -------------------------------------------

Our
consolidated financial statements as of and for the years ended December 31, 2005 and 2006 and the Report of Deloitte & Touche LLP, Independent Registered Public Accounting Firm, are included in this Annual Report on Form 10-K.

Our consolidated statements of operations, stockholders equity, and cash flows for the year ended December 31, 2004 and the
Report of McGladrey & Pullen, LLP, Independent Registered Public Accounting Firm, are included in this Annual Report on Form 10-K.



|Item 9. | Changes in and Disagreements with Accountants on Accounting and Financial Disclosure
|------- | ------------------------------------------------------------------------------------

None.



50



---

##### Table of Contents

|Item 9A. | Controls and Procedures
|-------- | -----------------------

Disclosure Controls and Procedures

We maintain disclosure controls and procedures that are designed to ensure that information required to be disclosed in our Exchange
Act reports is recorded, processed, summarized and reported within the time periods specified in the SECs rules and forms and that such information is accumulated and communicated to our management including our Chief Executive Officer and
Chief Financial Officer, as appropriate, to allow for timely decisions regarding required disclosure. In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well
designed and operated can provide only reasonable assurance of achieving the desired control objectives and management is required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

As required by Rule 13a-15(b) under the Exchange Act, we conducted an evaluation, under the supervision and with the participation of our management,
including our Chief Executive Officer and our Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this report. Based upon the foregoing
evaluation, our principal executive officer and our principal financial officer concluded that as of December 31, 2006, as a result of the material weakness in internal control over financial reporting discussed below, our disclosure controls
and procedures were not effective at the reasonable assurance level.

In connection with the audit of our financial statements for the year
ended December 31, 2006, in March 2007, our independent registered public accounting firm reported to our audit committee a material weakness in our internal controls over financial reporting. More specifically, we did not have
adequate controls and procedures to assure proper accounts payable accruals for services rendered and billed but not yet paid, and as a result, we recorded post-closing adjustments to our books and records and financial statements for the year ended
December 31, 2006.

We have begun efforts to remediate the above mentioned material weakness through the hiring of additional
resources within our Finance department. Furthermore, we will be implementing additional monthly closing checklists to ensure liabilities with significant vendors are properly reconciled and accrued. Although initiated, our plan to improve the
effectiveness of our internal controls and processes is not complete. We expect to complete the remediation of the material weakness as quickly as possible but cannot at this time estimate how long it will take to complete the steps identified
above.

Changes in our internal controls

The material weaknesses reported by our independent registered public accounting firm in connection with their audit of our financial statements for the nine months ended September 30, 2006 are summarized below:



| |  |  | We did not have adequate controls to provide reasonable assurance that revenue was being recorded in accordance with generally accepted accounting principles. The
inadequate controls resulted in the premature recognition of revenue that should have been deferred to a later period, in accordance with AICPA Statement of Position 97-2, Software Revenue Recognition (SOP 97-2) and AICPA Technical
Practice Aid, TIS Section 5100.69. Specifically, in the third quarter of 2005, we improperly recognized revenue in the amount of $244,000 prior to delivery of the related products. As a result of this error, an adjustment was recorded to our
books and records and financial statements to defer revenue previously recorded during the quarter ended September 30, 2005 until the quarter ended December 31, 2005. The error resulted in a restatement of the previously reported quarterly
results.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We did not have adequate controls and procedures to assure proper accounts payable accruals related to services rendered and billed but not yet paid, and, as a
result, we recorded post-closing adjustments to our books and records and financial statements for the nine months ended September 30, 2006.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



51



---

##### Table of Contents

The material weaknesses reported by our independent registered public accounting firm in connection with
their audit of our financial statements for the year ended December 31, 2005, are summarized below:



| |  |  | We did not have personnel within our accounting function that possessed an appropriate level of experience in the selection and application of GAAP to provide
reasonable assurance that transactions were being appropriately recorded. Additionally, the training of employees and written communication regarding duties and control responsibilities was inadequate to ensure that processes and control activities
were being carried out effectively.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We did not have adequate controls to provide reasonable assurance that all elements of contractual arrangements with customers were being recorded in accordance
with GAAP. Specifically, we did not have adequate controls to properly determine the frequency of upgrades and enhancements. Significant errors involved customer contracts consisting of multiple elements, such as license, professional services
and maintenance fees. Errors in allocating revenue among these elements resulted in the premature recognition of revenue that should have been deferred to later periods, in accordance with SOP 97-2 and related interpretations. As a result of these
identified deficiencies, material revenue-related post-closing adjustments were recorded to our financial statements to defer revenue from the periods in which they were originally recorded until such time as the appropriate revenue recognition
criteria were met. In addition, other revenue recognition related errors were identified resulting primarily from a lack of secondary review over the application of accounting principles to specific contract terms as well as the analysis and
estimates supporting the amounts recorded. These errors resulted from the lack of a systematic process for accumulating information underlying recorded revenue as well as the lack of appropriate levels of review.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We did not have adequate controls and procedures with respect to the reconciliation of general ledger account balances to supporting detail; recording and analysis
of certain accounts, including capitalized software development costs, lease transactions, accounts payable, stock compensation, asset disposals; and documentation of non-routine transactions. As a result of these material weaknesses, we
recorded material post-closing adjustments to our financial statements.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

As a result of the previously identified
material weaknesses, we made material changes in our internal controls as described below. Given that our remediation efforts continue, these actions also serve as additional procedures and analyses to ensure that our consolidated financial
statements are prepared in accordance with generally accepted accounting principles in the United States of America.



| |  |  | We hired additional experienced accounting personnel in an effort to increase the experience level within our accounting department, including the hiring of a new
corporate controller and an individual with significant experience applying generally accepted accounting principles related to software revenue recognition. Our new controller participated in the June 30, 2006, September 30, 2006,
and December 31, 2006 financial closing and reporting processes, which added an additional level of supervisory review.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We modified our general ledger reporting structure to reduce the number of accounts to which we record journal entries. These changes have enabled us to focus more
time on the review and analysis of the financial information we report.
| | - |  | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | In connection with our June 30, 2006, September 30, 2006, and December 31, 2006 financial and closing processes, we reviewed all significant
cash disbursements made subsequent to those dates in order to determine that accounts payable and accrued expenses were appropriately stated at those dates. These reviews were performed under the supervision of our new corporate controller.
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | We have documented and implemented additional review procedures relative to the financial close process which were performed by the managers of each functional
department within our accounting department in connection with the June 30, 2006, September 30, 2006, and December 31, 2006 financial close processes.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

For the year ended December 31, 2006 management was not required to and did not perform an evaluation of our internal controls over financial
reporting.



52



---

##### Table of Contents

PART III



|Item 10. | Directors and Executive Officers of the Registrant
|-------- | --------------------------------------------------

The information required by this item will be set forth in the Proxy Statement or Form 10-K/A and is incorporated in this report by reference.



|Item 11. | Executive Compensation
|-------- | ----------------------

The information required by
this item will be set forth in the Proxy Statement or Form 10-K/A and is incorporated in this report by reference.



|Item 12. | Security Ownership of Certain Beneficial Owners and Management and Related Shareholder Matters
|-------- | ----------------------------------------------------------------------------------------------

The information required by this item will be set forth in the Proxy Statement or Form 10-K/A and is incorporated in this report by reference.



|Item 13. | Certain Relationships and Related Transactions
|-------- | ----------------------------------------------

The
information required by this item will be set forth in the Proxy Statement or Form 10-K/A and is incorporated in this report by reference.



|Item 14. | Principal Accountant Fees and Services
|-------- | --------------------------------------

The
information required by this item will be set forth in the Proxy Statement or Form 10-K/A and is incorporated in this report by reference.



53



---

##### Table of Contents

PART IV



|Item 15. | Exhibits and Financial Statement Schedules
|-------- | ------------------------------------------

The
following documents are filed as part of this report:



|                                                                                               |  |           
|---------------------------------------------------------------------------------------------- |  | ----------
|                                                                                               |  | PageNumber
|                                                                                               | 
|(a)    Financial Statements:                                                                   |  |           
|(1)    
Report of Independent Registered Public Accounting FirmDeloitte & Touche LLP          |  | F-2       
|Report of Independent Registered Public Accounting FirmMcGladrey & Pullen, LLP                |  | F-3       
|Consolidated Balance Sheets at December 31, 2005 and 2006                                      |  | F-4       
|Consolidated Statements of Operations for the years ended December 31, 2004, 2005 and 2006     |  | F-5       
|Consolidated Statements of Stockholders Equity for the years ended December 31, 2005 and 2006 |  | F-6       
|Consolidated Statements of Cash Flows for the years ended December 31, 2004, 2005 and 2006     |  | F-7       
|Notes to Consolidated Financial Statements                                                     |  | F-8       
|                                                                                               | 
|(2)    
Signatures                                                                             |  | S-1       
|Schedule IIValuation and Qualifying Accounts                                                  |  | II-1      

Financial statement schedules other than those listed above have been omitted because they are
either not required, not applicable or the information is otherwise included.



| | (3) | List of exhibits required by Item 601 of Regulation S-K. See part (b) below.
| | --- | ----------------------------------------------------------------------------



|(b) | Exhibits:
|--- | ---------



|              |  |                                                                                                                    
|------------- |  | -------------------------------------------------------------------------------------------------------------------
|ExhibitNumber |  | Description of Documents                                                                                           
|              | 
|3.1(1)        |  | Amended and Restated Certificate of Incorporation of the registrant                                                
|              | 
|3.2(1)        |  | Amended and Restated Bylaws of the registrant                                                                      
|              | 
|3.3(1)        |  | Specimen Common Stock Certificate                                                                                  
|              | 
|4.1(1)        |  | Investors Rights Agreement, dated as of September 26, 2003, by and between the registrant and Matthew Healey      
|              | 
|10.1(1)       |  | Restated Lease Agreement, dated as of April 1, 2003, by and between the registrant and The Walnut Plaza, as amended
|              | 
|10.2(1)#      |  | Amended and Restated 2004 Equity Incentive Plan                                                                    
|              | 
|10.3(1)#      |  | Executive Retention and Severance Plan                                                                             
|              | 
|10.4(1)#      |  | Employment Agreement, dated January 1, 2000, by and between the registrant and John Patzakis, as amended           
|              | 
|10.5(1)#      |  | Employment Agreement, dated September 5, 2000, by and between the registrant and John Colbert, as amended          
|              | 
|10.6(1)#      |  | Employment Agreement, Dated December 16, 2002, by and between the registrant and Frank Sansone                     
|              | 
|10.7(1)#      |  | Employment Agreement, dated March 31, 2004, by and between the registrant and Victor Limongelli                    



54



---

##### Table of Contents

|              |  |                                                                                                                                                      
|------------- |  | -----------------------------------------------------------------------------------------------------------------------------------------------------
|ExhibitNumber |  | Description of Documents                                                                                                                             
|              | 
|10.8(1)*      |  | License Agreement, dated as of June 30, 2005, by and between the registrant and Stellent Chicago Sales, Inc.                                         
|              | 
|10.9(1)       |  | Form of Tax Matters Agreement                                                                                                                        
|              | 
|10.10(1)      |  | Credit Agreement entered into as of May 4, 2005, by and between Bank of the West and the registrant                                                  
|              | 
|10.11(1)      |  | Fourth Amendment entered into as of November 20, 2006, to the Credit Agreement, dated May 4, 2005, by and between Bank of the West and the registrant
|              | 
|10.12(1)      |  | Form of Indemnification Agreement                                                                                                                    
|              | 
|10.13(1)      |  | Form of 2004 Stock Option Agreement                                                                                                                  
|              | 
|21.1(1)       |  | List of Subsidiaries                                                                                                                                 
|              | 
|23.1          |  | Consent of Deloitte & Touche LLP, Independent Registered Public Accounting Firm                                                                      
|              | 
|23.2          |  | Consent of McGladrey & Pullen, LLP, Independent Registered Public Accounting Firm                                                                    
|              | 
|31.1          |  | Certification of Chief Executive Officer pursuant to Rules 13a-14 and 15d-14 promulgated under the Securities Exchange Act of 1934                   
|              | 
|31.2          |  | Certification of Chief Financial Officer pursuant to Rules 13a-14 and 15d-14 promulgated under the Securities Exchange Act of 1934                   
|              | 
|32.1         |  | Certification of Chief Executive Officer pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002    
|              | 
|32.2         |  | Certification of Chief Financial Officer pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002    

---

|(1) | Incorporated by reference to the Companys Registration Statement on Form S-1 filed with the Securities and Exchange Commission on September 15, 2006, as amended (File
No. 333-137381).
|--- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

|# | Indicates management contract or compensatory plan.
|- | ---------------------------------------------------

|* | Portions of the exhibit have been omitted pursuant to a request for confidential treatment and submitted separately to the Securities and Exchange Commission.
|- | --------------------------------------------------------------------------------------------------------------------------------------------------------------

| | These certifications are being furnished solely to accompany this annual report pursuant to 18 U.S.C. Section 1350, and are not being filed for purposes of Section 18 of
the Securities Exchange Act of 1934 and are not to be incorporated by reference into any filing of Guidance Software, Inc., whether made before or after the date hereof, regardless of any general incorporation language in such filing.
|- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



55



---

##### Table of Contents

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS



|                                                                                |  |    
|------------------------------------------------------------------------------- |  | ---
|Report of Independent Registered Public Accounting FirmDeloitte & Touche LLP   |  | F-2
|                                                                                | 
|Report of Independent Registered Public Accounting FirmMcGladrey & Pullen, LLP |  | F-3
|                                                                                | 
|Consolidated Balance Sheets                                                     |  | F-4
|                                                                                | 
|Consolidated Statements of Operations                                           |  | F-5
|                                                                                | 
|Consolidated Statements of Stockholders Equity                                 |  | F-6
|                                                                                | 
|Consolidated Statements of Cash Flows                                           |  | F-7
|                                                                                | 
|Notes to Consolidated Financial Statements                                      |  | F-8



F-1



---

##### Table of Contents

REPORT OF INDEPENDENT REGISTERED

PUBLIC ACCOUNTING FIRM

To the Board of Directors and Stockholders of

Guidance Software, Inc.

Pasadena, California

We have audited the
accompanying consolidated balance sheets of Guidance Software, Inc. and subsidiaries (the Company) as of December 31, 2006 and 2005, and the related consolidated statements of operations, stockholders equity, and cash flows
for each of the two years in the period ended December 31, 2006. Our audits also included the financial statement schedule listed in the Index at Item 15. These financial statements and financial statement schedule are the responsibility
of the Companys management. Our responsibility is to express an opinion on the financial statements and financial statement schedule based on our audits.

We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance
about whether the financial statements are free of material misstatement. The Company is not required to have, nor were we engaged to perform, an audit of its internal control over financial reporting. Our audits included consideration of internal
control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Companys internal control over financial
reporting. Accordingly, we express no such opinion. An audit also includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates
made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.

In our opinion, such consolidated financial statements present fairly, in all material respects, the financial position of Guidance Software, Inc. and subsidiaries at December 31, 2006 and 2005, and the results
of their operations and their cash flows for each of the two years in the period ended December 31, 2006, in conformity with accounting principles generally accepted in the United States of America. Also, in our opinion, such financial
statement schedule, when considered in relation to the basic consolidated financial statements taken as a whole, present fairly in all material respects the information set forth therein.

As discussed in Note 10 to the consolidated financial statements, the Company changed the manner in which it accounts for share-based compensation in
2006.

/s/ Deloitte & Touche LLP

Los Angeles,
California

March 29, 2007



F-2



---

##### Table of Contents

REPORT OF INDEPENDENT REGISTERED

PUBLIC ACCOUNTING FIRM

To the Board of Directors and Stockholders of

Guidance Software, Inc.

Pasadena, California

We have audited the
accompanying consolidated statements of operations, stockholders deficit, and cash flows of Guidance Software, Inc. and subsidiary (the Company) for the year ended December 31, 2004. Our audit also included the financial
statement schedule of the Company listed in Item 15(a). These financial statements and financial statement schedule are the responsibility of the Companys management. Our responsibility is to express an opinion on these financial
statements based on our audit.

We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board
(United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting
the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe
that our audit provided a reasonable basis for our opinion.

In our opinion, the consolidated financial statements referred to above
present fairly, in all material respects, the results of its operations and its cash flows for the year ended December 31, 2004, in conformity with accounting principles generally accepted in the United States of America. Also in our opinion,
the related financial statement schedule, when considered in relation to the basic consolidated financial statements taken as a whole, presents fairly in all material respects the information set forth therein.

/s/ McGladrey & Pullen, LLP

Pasadena, California

April 4, 2005, except for Notes 16 and 17, as to which the date is September 15, 2006.



F-3



---

##### Table of Contents

GUIDANCE SOFTWARE, INC.

CONSOLIDATED BALANCE SHEETS

(in thousands, except per share data)



|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|------------------------------------------------------------------------------------------------------------------------------------------------------------------ |  | ------------------ | ------ | - | ---- | - | ------ | -
|                                                                                                                                                                   |  | As of December 31, |       
|                                                                                                                                                                   |  | 2005               |        |   | 2006 |  
|ASSETS                                                                                                                                                             |  |                    |        |   |      |   |        |  
|Current assets:                                                                                                                                                    |  |                    |        |   |      |   |        |  
|Cash and cash equivalents                                                                                                                                          |  | $                  | 7,556  |   |      | $ | 8,041  |  
|Investments in marketable debt securities                                                                                                                          |  |                    |       |   |      |   | 24,694 |  
|Trade receivable, net of allowance for doubtful accounts of $139 and $442 as of December 31, 2005 and 2006, respectively                                           |  |                    | 10,235 |   |      |   | 17,513 |  
|Prepaid expenses, inventory and other current assets                                                                                                               |  |                    | 710    |   |      |   | 2,064  |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|Total current assets                                                                                                                                               |  |                    | 18,501 |   |      |   | 52,312 |  
|Property and equipment, net                                                                                                                                        |  |                    | 2,839  |   |      |   | 6,526  |  
|Other assets                                                                                                                                                       |  |                    | 162    |   |      |   | 507    |  
|Capitalized offering costs                                                                                                                                         |  |                    | 24     |   |      |   |       |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|Total assets                                                                                                                                                       |  | $                  | 21,526 |   |      | $ | 59,345 |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|LIABILITIES AND STOCKHOLDERS (DEFICIT) EQUITY                                                                                                                     |  |                    |        |   |      |   |        |  
|Current liabilities:                                                                                                                                               |  |                    |        |   |      |   |        |  
|Accounts payable                                                                                                                                                   |  | $                  | 1,820  |   |      | $ | 5,494  |  
|Accrued expenses                                                                                                                                                   |  |                    | 3,664  |   |      |   | 3,974  |  
|Capital leases                                                                                                                                                     |  |                    | 472    |   |      |   | 942    |  
|Deferred revenues                                                                                                                                                  |  |                    | 13,905 |   |      |   | 18,123 |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|Total current liabilities                                                                                                                                          |  |                    | 19,861 |   |      |   | 28,533 |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|Long-term liabilities:                                                                                                                                             |  |                    |        |   |      |   |        |  
|Rent incentives                                                                                                                                                    |  |                    | 805    |   |      |   | 1,537  |  
|Capital leases                                                                                                                                                     |  |                    | 261    |   |      |   | 488    |  
|Deferred revenues                                                                                                                                                  |  |                    | 2,414  |   |      |   | 2,098  |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|Total long-term liabilities                                                                                                                                        |  |                    | 3,480  |   |      |   | 4,123  |  
|Commitments and contingencies (Notes 8 and 15)                                                                                                                     |  |                    |        |   |      |   |        |  
|Stockholders (deficit) equity:                                                                                                                                    |  |                    |        |   |      |   |        |  
|Preferred stock, $0.001 par value: 10,000,000 shares authorized; no shares issued or outstanding at December 31, 2005 and
2006                                     |  |                    |       |   |      |   |       |  
|Common stock, $0.001 par value; 100,000,000 shares authorized; 20,412,000 and 22,167,000 shares issued and outstanding at December 31,
2005 and 2006, respectively |  |                    | 20     |   |      |   | 22     |  
|Additional paid-in capital                                                                                                                                         |  |                    | 3,032  |   |      |   | 36,330 |  
|Accumulated other comprehensive loss                                                                                                                               |  |                    |       |   |      |   | (17    | )
|Accumulated deficit                                                                                                                                                |  |                    | (4,867 | ) |      |   | (9,646 | )
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|Total stockholders (deficit) equity                                                                                                                               |  |                    | (1,815 | ) |      |   | 26,689 |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  
|Total liabilities and stockholders (deficit) equity                                                                                                               |  | $                  | 21,526 |   |      | $ | 59,345 |  
|                                                                                                                                                                   |  |                    |        |   |      |   |        |  

See Notes to Consolidated Financial Statements



F-4



---

##### Table of Contents

GUIDANCE SOFTWARE, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS

(in thousands, except per share data)



|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|---------------------------------------------------------------- |  | ------------------ | ------ | - | ---- | - | ------ | ---- |  | - | ------ | -
|                                                                 |  | As of December 31, |       
|                                                                 |  | 2004               |        |   | 2005 |   |        | 2006 | 
|Revenues:                                                        |  |                    |        |   |      |   |        |      |  |   |        |  
|Product revenue                                                  |  | $                  | 15,812 |   |      | $ | 23,138 |      |  | $ | 32,565 |  
|Services and maintenance revenue                                 |  |                    | 11,792 |   |      |   | 16,367 |      |  |   | 23,300 |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Total revenues                                                   |  |                    | 27,604 |   |      |   | 39,505 |      |  |   | 55,865 |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Cost of revenues                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Cost of product revenue                                          |  |                    | 1,685  |   |      |   | 2,202  |      |  |   | 2,429  |  
|Cost of services and maintenance revenue                         |  |                    | 7,930  |   |      |   | 9,146  |      |  |   | 13,639 |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Total cost of revenues                                           |  |                    | 9,615  |   |      |   | 11,348 |      |  |   | 16,068 |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Gross profit                                                     |  |                    | 17,989 |   |      |   | 28,157 |      |  |   | 39,797 |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Operating expenses:                                              |  |                    |        |   |      |   |        |      |  |   |        |  
|Selling and marketing                                            |  |                    | 10,461 |   |      |   | 15,691 |      |  |   | 26,238 |  
|Research and development                                         |  |                    | 3,295  |   |      |   | 4,680  |      |  |   | 7,113  |  
|General and administrative                                       |  |                    | 3,894  |   |      |   | 4,923  |      |  |   | 7,840  |  
|Depreciation and amortization                                    |  |                    | 1,158  |   |      |   | 1,357  |      |  |   | 1,823  |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Total operating expenses                                         |  |                    | 18,808 |   |      |   | 26,651 |      |  |   | 43,014 |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Operating (loss) income                                          |  |                    | (819   | ) |      |   | 1,506  |      |  |   | (3,217 | )
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Other income and expense:                                        |  |                    |        |   |      |   |        |      |  |   |        |  
|Interest income                                                  |  |                    | 3      |   |      |   | 54     |      |  |   | 105    |  
|Interest expense                                                 |  |                    | (112   | ) |      |   | (81    | )    |  |   | (91    | )
|Other income, net                                                |  |                    | 146    |   |      |   | 150    |      |  |   | 173    |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|(Loss) income before income taxes                                |  |                    | (782   | ) |      |   | 1,629  |      |  |   | (3,030 | )
|Income tax provision                                             |  |                    | 10     |   |      |   | 13     |      |  |   | 39     |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Net (loss) income                                                |  | $                  | (792   | ) |      | $ | 1,616  |      |  | $ | (3,069 | )
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Net (loss) income per share:                                     |  |                    |        |   |      |   |        |      |  |   |        |  
|Basic                                                            |  | $                  | (0.04  | ) |      | $ | 0.08   |      |  | $ | (0.16  | )
|Diluted                                                          |  | $                  | (0.04  | ) |      | $ | 0.08   |      |  | $ | (0.16  | )
|Weighted average number of shares used in per share calculation: |  |                    |        |   |      |   |        |      |  |   |        |  
|Basic                                                            |  |                    | 19,431 |   |      |   | 20,412 |      |  |   | 19,530 |  
|Diluted                                                          |  |                    | 19,431 |   |      |   | 21,023 |      |  |   | 19,530 |  
|Pro forma net (loss) income data (unaudited)                     |  |                    |        |   |      |   |        |      |  |   |        |  
|(Loss) income before income taxes                                |  | $                  | (782   | ) |      | $ | 1,629  |      |  | $ | (3,030 | )
|Pro forma provision for income taxes                             |  |                    | 10     |   |      |   | 343    |      |  |   | 39     |  
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  
|Pro forma net income                                             |  | $                  | (792   | ) |      | $ | 1,286  |      |  | $ | (3,069 | )
|                                                                 |  |                    |        |   |      |   |        |      |  |   |        |  

See Notes to Consolidated Financial Statements



F-5



---

##### Table of Contents

GUIDANCE SOFTWARE, INC.

CONSOLIDATED STATEMENTS OF STOCKHOLDERS EQUITY

(in thousands)



|                                                                      |  |                 |  |              |   |        |                           |   |                                  |   |    |                                      |  |   |                     |  |   |                                    |   |  |   |     |   |  |   |        |   |  |   |        |  
|--------------------------------------------------------------------- |  | --------------- |  | ------------ | - | ------ | ------------------------- | - | -------------------------------- | - | -- | ------------------------------------ |  | - | ------------------- |  | - | ---------------------------------- | - |  | - | --- | - |  | - | ------ | - |  | - | ------ | -
|                                                                      |  | Preferred Stock |  | Common Stock |   |        | AdditionalPaid-in Capital |   | DeferredShare-Based Compensation |   |    | AccumulatedOtherComprehensive Income |  |   | Accumulated Deficit |  |   | TotalStockholders (Deficit)Equity |  
|                                                                      |  | Shares          |  | Amount       |   | Shares |                           |   | Amount                           |   |    |                                      |  |   |                    
|Balances at January 1, 2004                                           |  |                |  | $            |  |        | 20,412                    |   |                                  | $ | 20 |                                      |  | $ | 3,032               |  | $ | (108                               | ) |  | $ |    |   |  | $ | (5,691 | ) |  | $ | (2,747 | )
|Amortization of deferred share-based compensation                     |  |                |  |              |  |        |                          |   |                                  |   |   |                                      |  |   |                    |  |   | 108                                |   |  |   |    |   |  |   |       |   |  |   | 108    |  
|Net loss                                                              |  |                |  |              |  |        |                          |   |                                  |   |   |                                      |  |   |                    |  |   |                                   |   |  |   |    |   |  |   | (792   | ) |  |   | (792   | )
|                                                                      |  |                 |  |              |   |        |                           |   |                                  |   |    |                                      |  |   |                     |  |   |                                    |   |  |   |     |   |  |   |        |   |  |   |        |  
|Balances at December 31, 2004                                         |  |                |  |              |  |        | 20,412                    |   |                                  |   | 20 |                                      |  |   | 3,032               |  |   |                                   |   |  |   |    |   |  |   | (6,483 | ) |  |   | (3,431 | )
|Net income                                                            |  |                |  |              |  |        |                          |   |                                  |   |   |                                      |  |   |                    |  |   |                                   |   |  |   |    |   |  |   | 1,616  |   |  |   | 1,616  |  
|                                                                      |  |                 |  |              |   |        |                           |   |                                  |   |    |                                      |  |   |                     |  |   |                                    |   |  |   |     |   |  |   |        |   |  |   |        |  
|Balances at December 31, 2005                                         |  |                |  |              |  |        | 20,412                    |   |                                  |   | 20 |                                      |  |   | 3,032               |  |   |                                   |   |  |   |    |   |  |   | (4,867 | ) |  |   | (1,815 | )
|Share-based compensation                                              |  |                |  |              |  |        |                          |   |                                  |   |   |                                      |  |   | 1,102               |  |   |                                   |   |  |   |    |   |  |   |       |   |  |   | 1,102  |  
|Exercise of stock options                                             |  |                |  |              |  |        | 361                       |   |                                  |   | 1  |                                      |  |   | 1,651               |  |   |                                   |   |  |   |    |   |  |   |       |   |  |   | 1,652  |  
|Exercise of warrant                                                   |  |                |  |              |  |        | 206                       |   |                                  |   |   |                                      |  |   |                    |  |   |                                   |   |  |   |    |   |  |   |       |   |  |   |       |  
|Donated capital, retired                                              |  |                |  |              |  |        | (2,062                    | ) |                                  |   | (2 | )                                    |  |   | 2                   |  |   |                                   |   |  |   |    |   |  |   |       |   |  |   |       |  
|Stockholder distributions                                             |  |                |  |              |  |        |                          |   |                                  |   |   |                                      |  |   |                    |  |   |                                   |   |  |   |    |   |  |   | (1,710 | ) |  |   | (1,710 | )
|Issuance of common stock in public offering, net of issuance costs    |  |                |  |              |  |        | 3,250                     |   |                                  |   | 3  |                                      |  |   | 30,543              |  |   |                                   |   |  |   |    |   |  |   |       |   |  |   | 30,546 |  
|Unrealized losses on marketable debt securities, net of related taxes |  |                |  |              |  |        |                          |   |                                  |   |   |                                      |  |   |                    |  |   |                                   |   |  |   | (17 | ) |  |   |       |   |  |   | (17    | )
|Net loss                                                              |  |                |  |              |  |        |                          |   |                                  |   |   |                                      |  |   |                    |  |   |                                   |   |  |   |    |   |  |   | (3,069 | ) |  |   | (3,069 | )
|                                                                      |  |                 |  |              |   |        |                           |   |                                  |   |    |                                      |  |   |                     |  |   |                                    |   |  |   |     |   |  |   |        |   |  |   |        |  
|Balances at December 31, 2006                                         |  |                |  | $            |  |        | 22,167                    |   |                                  | $ | 22 |                                      |  | $ | 36,330              |  | $ |                                   |   |  | $ | (17 | ) |  | $ | (9,646 | ) |  | $ | 26,689 |  
|                                                                      |  |                 |  |              |   |        |                           |   |                                  |   |    |                                      |  |   |                     |  |   |                                    |   |  |   |     |   |  |   |        |   |  |   |        |  

See Notes to Consolidated Financial Statements



F-6



---

##### Table of Contents

GUIDANCE SOFTWARE, INC.

CONSOLIDATED STATEMENTS OF CASH FLOWS

(in thousands)



|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|-------------------------------------------------------------------------------------------------- |  | ----------------------- | ------ | - | ---- | - | ------ | ---- |  | - | ------- | -
|                                                                                                   |  | Year Ended December 31, |       
|                                                                                                   |  | 2004                    |        |   | 2005 |   |        | 2006 | 
|Cash flows from operating activities:                                                              |  |                         |        |   |      |   |        |      |  |   |         |  
|Net (loss) income                                                                                  |  | $                       | (792   | ) |      | $ | 1,616  |      |  | $ | (3,069  | )
|Adjustments to reconcile net (loss) income to net cash provided by (used in) operating activities: |  |                         |        |   |      |   |        |      |  |   |         |  
|Depreciation and amortization                                                                      |  |                         | 1,158  |   |      |   | 1,357  |      |  |   | 1,823   |  
|Allowance for doubtful accounts                                                                    |  |                         | 192    |   |      |   | 97     |      |  |   | 514     |  
|Share-based compensation                                                                           |  |                         | 108    |   |      |   |       |      |  |   | 1,102   |  
|Loss on disposal of assets                                                                         |  |                         | 22     |   |      |   |       |      |  |   | 93      |  
|Changes in operating assets and liabilities:                                                       |  |                         |        |   |      |   |        |      |  |   |         |  
|Increase in trade receivables                                                                      |  |                         | (3,612 | ) |      |   | (3,822 | )    |  |   | (7,792  | )
|Increase in prepaid expenses, inventory and other assets                                           |  |                         | (133   | ) |      |   | (243   | )    |  |   | (1,311  | )
|Increase in accounts payable                                                                       |  |                         | 99     |   |      |   | 775    |      |  |   | 1,476   |  
|Increase in accrued expenses                                                                       |  |                         | 945    |   |      |   | 1,248  |      |  |   | 459     |  
|Increase in deferred revenue                                                                       |  |                         | 3,191  |   |      |   | 6,509  |      |  |   | 3,902   |  
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Net cash provided by (used in) operating activities                                                |  |                         | 1,178  |   |      |   | 7,537  |      |  |   | (2,803  | )
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Cash flows from investing activities:                                                              |  |                         |        |   |      |   |        |      |  |   |         |  
|Purchase of property and equipment                                                                 |  |                         | (944   | ) |      |   | (1,011 | )    |  |   | (2,363  | )
|Purchase of marketable debt securities                                                             |  |                         |       |   |      |   |       |      |  |   | (24,711 | )
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Net cash used in investing activities                                                              |  |                         | (944   | ) |      |   | (1,011 | )    |  |   | (27,074 | )
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Cash flows from financing activities:                                                              |  |                         |        |   |      |   |        |      |  |   |         |  
|Distributions to stockholders                                                                      |  |                         |       |   |      |   |       |      |  |   | (1,710  | )
|Proceeds from term loan                                                                            |  |                         | 1,000  |   |      |   |       |      |  |   | 900     |  
|Principal payments of term loan                                                                    |  |                         | (306   | ) |      |   |       |      |  |   | (900    | )
|Principal payments of line of credit                                                               |  |                         | (800   | ) |      |   | (792   | )    |  |   |        |  
|Principal payments of note payable to stockholder                                                  |  |                         | (200   | ) |      |   |       |      |  |   |        |  
|Principal payments of capital lease obligations                                                    |  |                         | (360   | ) |      |   | (457   | )    |  |   | (582    | )
|Proceeds from initial public offering, net of underwriters discount                               |  |                         |       |   |      |   |       |      |  |   | 34,759  |  
|Cash paid for offering expense                                                                     |  |                         |       |   |      |   | (24    | )    |  |   | (3,757  | )
|Proceeds from the exercise of stock options                                                        |  |                         |       |   |      |   |       |      |  |   | 1,652   |  
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Net cash (used in) provided by financing activities                                                |  |                         | (666   | ) |      |   | (1,273 | )    |  |   | 30,362  |  
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Net (decrease) increase in cash and cash equivalents                                               |  |                         | (432   | ) |      |   | 5,253  |      |  |   | 485     |  
|Cash and cash equivalents, beginning of period                                                     |  |                         | 2,735  |   |      |   | 2,303  |      |  |   | 7,556   |  
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Cash and cash equivalents, end of period                                                           |  | $                       | 2,303  |   |      | $ | 7,556  |      |  | $ | 8,041   |  
|                                                                                                   |  |                         |        |   |      |   |        |      |  |   |         |  
|Supplemental disclosures of cash flow information:                                                 |  |                         |        |   |      |   |        |      |  |   |         |  
|Net cash paid during the year for:                                                                 |  |                         |        |   |      |   |        |      |  |   |         |  
|Interest                                                                                           |  | $                       | 112    |   |      | $ | 82     |      |  | $ | 87      |  
|Income taxes                                                                                       |  | $                       | 10     |   |      | $ | 13     |      |  | $ | 39      |  
|Non-cash activities:                                                                               |  |                         |        |   |      |   |        |      |  |   |         |  
|Capital lease obligations incurred to acquire assets                                               |  | $                       | 591    |   |      | $ | 537    |      |  | $ | 1,279   |  
|Purchase of equipment included in accounts payable                                                 |  | $                       |       |   |      | $ | 97     |      |  | $ | 1,766   |  
|Accrued offering costs included in accounts payable                                                |  | $                       |       |   |      | $ |       |      |  | $ | 432     |  
|Rent incentives                                                                                    |  | $                       |       |   |      | $ |       |      |  | $ | 195     |  

See Notes to Consolidated Financial Statements



F-7



---

##### Table of Contents

GUIDANCE SOFTWARE, INC.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS

Note 1.    Description of the Business and Summary of Significant Accounting Policies

General

Guidance Software,
Inc. was incorporated in the state of California during 1997 and reincorporated in Delaware on December 11, 2006. Headquartered in Pasadena, California, Guidance is a global provider of software solutions to conduct digital investigations. The
Companys flagship product is EnCase®
Enterprise, a comprehensive, network-enabled digital solution that enables corporations and government agencies to search, collect, preserve and analyze data across all of the servers, desktops and laptops that comprise their entire network from a
single location. We also sell EnCase® Forensic,
primarily for use by law enforcement and government agencies for collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court proceedings. We complement our software offerings with a
comprehensive array of professional and training services including technical support and maintenance services to help our customers implement our solutions, conduct investigations and train their IT professionals to effectively and efficiently use
our software products.

Basis of Presentation

The accompanying consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States, or (GAAP). The consolidated financial statements
include the accounts of Guidance and its wholly owned subsidiaries. Guidance and its subsidiaries are collectively referred to herein as Guidance, We or the Company. All significant intercompany accounts and
transactions have been eliminated.

Use of Estimates and Assumptions

The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and judgments
that affect the reported amounts of assets, liabilities, revenues and expenses, and related disclosure of contingent assets and liabilities. On an ongoing basis, we evaluate these estimates, including those related to bad debts, income taxes,
commitments, contingencies and litigation. We base our estimates on historical experience and on various other assumptions that are believed to be reasonable under the circumstances. Actual results may differ from these estimates.

Cash and Cash Equivalents

The
Company invests its excess cash in money market funds and in highly liquid debt instruments of the U.S. government and its agencies. Highly liquid investments with stated maturities of three months or less from date of purchase are classified as
cash equivalents.

Investments in Marketable Debt Securities

The Company accounts for its investments in marketable debt securities in accordance with Financial Accounting Standards Board (FASB)
No. 115, Accounting for Certain Investments in Debt and Equity Securities. The Company determines the appropriate classification of its investments in marketable debt securities at the time of purchase and reevaluates such
designation at each balance sheet date. In response to changes in the availability of and the yield on alternative investments as well as liquidity requirements, we may sell these debt securities prior to their stated maturities. Accordingly,
marketable debt securities have been classified and accounted for as available for sale. These securities are carried at fair value, with the unrealized gains and losses, net of taxes, reported as a component of stockholders equity. When the fair
value of an investment declines below its original cost, the Company considers all available evidence to evaluate whether the



F-8



---

##### Table of Contents

decline is other-than-temporary. Among other things, the Company considers the duration and extent of the decline and economic factors influencing the
markets. To date, the Company has had no such other-than-temporary declines below cost. Any realized gains or losses on the sale of marketable securities are determined on a specific identification method and are reflected as a component of other
expense.

Fair Value of Financial Instruments

The carrying amounts of cash equivalents, accounts receivable, and accounts payable approximate fair value because of the short-term maturities of these instruments. Based on borrowing rates currently available to the
Company for borrowings with similar terms, the carrying values of the Companys capital lease obligations also approximate fair value. Marketable debt securities are stated at fair value based on market quotes.

Trade Receivables

Trade
receivables are carried at original invoice amount less an estimate made for doubtful receivables based on a review of all outstanding amounts. Management determines the allowance for doubtful accounts by regularly evaluating individual trade
receivables and considering the customers financial condition and credit history. Trade receivables are written off when deemed uncollectible. A trade receivable is considered past due if any portion of the receivable balance is outstanding
for more than 45 days unless alternate terms are provided.

Inventory

Inventory is comprised of hardware and packaged software and valued at the lower of cost or market, using the first-in first out method.

Property and Equipment

The
cost of property and equipment, less applicable estimated residual values, is depreciated over the shorter of their estimated useful lives or the life of the capital lease (if applicable), on the straight-line method, from the date the specific
asset is completed, installed, and ready for use, as follows:



|                              |  |                                       
|----------------------------- |  | --------------------------------------
|                              |  | Estimated Useful Life (years)         
|Leasehold improvements        |  | Shorter of life of asset or lease term
|Furniture and other equipment |  | 5                                     
|Computer equipment            |  | 2-3                                   
|Purchased software            |  | 3                                     

Impairment of Long-Lived Assets

The Company reviews its long-lived assets in accordance with Statement of Financial Accounting Standards (SFAS) No. 144, Accounting
for the Impairment or Disposal of Long-Lived Assets, which provides guidance on the recognition and measurement of the impairment of long-lived assets to be held and used, and the measurement of long-lived assets to be disposed of by sale.
Long-lived assets are reviewed for impairment whenever events or changes in circumstances indicate that the carrying amount of an asset may not be recoverable. Recoverability of assets to be held and used is measured by a comparison of the carrying
amount of the assets to future net cash flows (undiscounted and without interest) expected to be generated by the asset. If such assets are considered to be impaired, the impairment to be recognized is measured by the amount by which the carrying
amount of the assets exceeds the fair value of the assets. Assets to be disposed of are reported at the lower of the carrying amount or fair value less costs to sell.

Concentrations of Credit Risk

Financial instruments that potentially subject the Company to
significant concentrations of credit risk consist primarily of cash and cash equivalents, marketable debt securities, and accounts receivable. The Company restricts investments in cash and cash equivalents to financial institutions with high credit
standing. At



F-9



---

##### Table of Contents

December 31, 2006, the majority of the Companys cash and cash equivalents were held at financial institutions located in California. Accounts at
these institutions are insured by the Federal Deposit Insurance Corporation up to $100,000. Uninsured balances aggregate approximately $5,311,000 as of December 31, 2006. The Company performs periodic evaluations of the relative credit standing
of financial institutions and limits the amount of risk by selecting financial institutions with a strong credit standing. At December 31, 2006, all of the Companys marketable debt securities were obligations of the U.S. Government. The
Company periodically performs credit evaluations of its customers and maintains reserves for potential losses on its accounts receivable.

Revenue Recognition

The Company generates revenues principally from the sale of its EnCase® Enterprise Edition (EEE) and EnCase® Forensic Edition (EFE) software products.
The Companys proprietary software is generally sold with one to three years of maintenance, which can be renewed at a stated renewal rate. Revenue associated with the sale of a software license is referred to as product revenue. Revenue
associated with the sale of maintenance services is referred to as maintenance revenue. The Company also generates revenues from in-house training courses, implementation and consulting services, in which the Company assists customers with the
performance of digital investigations and trains their IT professionals to use the Company software products, which are collectively referred to as services revenue. To a lesser extent, the Company also generates revenues from the sale of its
Premium License Support Program (PLSP) and FastBloc® hardware, which is also included in product revenues.

The Company applies the provisions of Statement of
Position (SOP) 97-2, Software Revenue Recognition, as amended by SOP 98-9, Modification of SOP 97-2, Software Revenue Recognition, With Respect to Certain Transactions. For arrangements that contain a non-software
deliverable such as hardware, the Company applies the provisions of Emerging Issues Task Force Issue No. (EITF) 03-05 Applicability of AICPA Statement of Position 97-2 to Non-Software Deliverables in an Arrangement Containing
More-Than-Incidental Software and recognizes revenue when all other revenue recognition criteria are met. While these statements govern the basis for revenue recognition, significant judgment and the use of estimates are required in connection
with the determination of the amount of product revenues and services and other revenues as well as the amount of deferred revenue to be recognized in each accounting period.

Product revenue.The timing of product revenue recognition is dependent on the nature of the product sold. Product arrangements
comprising multiple deliverables including software and hardware are generally categorized into one of the following:



| |  |  | EEE Solutions: Revenue associated with these arrangements, exclusive of amounts allocated to maintenance and other undelivered elements, for which the
Company has vendor-specific objective evidence (VSOE) of fair value, is recognized upon delivery, provided that all other criteria for revenue recognition have been met.
| | - |  | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | EFE Solutions: Prior to 2005, revenue from governmental agencies and commercial customers was recognized ratably over the longer of the contractual
maintenance period (12 months) or the implied maintenance period (12-25 months) as VSOE of fair value of the maintenance element did not exist. Beginning in 2005, based on substantive maintenance renewal provisions, the Company established VSOE of
fair value of the maintenance element for solutions sold to commercial customers. Accordingly, beginning in 2005, EFE revenue from commercial customers, exclusive of amounts allocated to maintenance for which the Company has VSOE of fair value, is
recognized upon delivery, provided that all other criteria for revenue recognition have been met. In the consolidated statement of operations, the Company allocates the EFE revenue from governmental customers that is recognized ratably, between
product revenue and services and maintenance revenue based on the estimated fair value of the maintenance portion of the EFE revenue.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | PLSP Solutions: Revenue resulting from these arrangements is recognized ratably over the three-year contractual period beginning with the delivery of the
first product, as the PLSP is a subscription arrangement entitling the customer to receive unspecified future products and post-contract customer support.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



F-10



---

##### Table of Contents

| |  |  | Hardware: Revenue associated with the sale of FastBloc® and other hardware is recognized upon shipment to the customer, provided (i) persuasive evidence of an arrangement exists, (ii) title and
risk of ownership has passed to the buyer, (iii) the fee is fixed or determinable and (iv) collection is deemed probable.
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Services and Maintenance Revenue.The majority of the Companys training, consulting and implementation services, which we collectively refer to as services revenue, are performed under per
hour, per disk drive or fixed fee arrangements. Revenue from such services is recognized as the services are provided or upon expiration of the contractual service period.

Revenue related to technical support and software updates on a when-and-if available basis which we refer to as maintenance revenue is also included in
services and maintenance revenue. The Company recognizes all maintenance revenue ratably over the applicable maintenance period. The Company determines the amount of maintenance revenue to be deferred through reference to substantive maintenance
renewal provisions contained in multiple element arrangements. The Company considers substantive maintenance provisions to be provisions where the cost of the maintenance renewal, stated in the contract with our customer as a percentage of the
product fee, is comparable to the normal pricing for maintenance only renewals.

Revenue Recognition Criteria.The
Company recognizes revenue when persuasive evidence of an arrangement exists, the element has been delivered, the fee is fixed or determinable and collection of the resulting receivable is probable. A discussion about these revenue recognition
criteria and their applicability to the Companys transactions follows:



| |  |  | Persuasive evidence of an arrangement: The Company either enters into contracts or receives written purchase orders issued by the customer as evidence of an
arrangement.
| | - |  | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Product delivery: The Company deems delivery of product to have occurred when the title and risk of ownership has passed to the buyer. Services revenue is
recognized as delivered.
| | - |  | -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Fixed or determinable fee: The Company considers the fee to be fixed or determinable if the fee is not subject to refund or adjustment and the payment terms
are within its normal established practices. If the fee is not fixed or determinable, the Company recognizes the revenue as amounts become due and payable provided all other revenue recognition criteria have been met.
| | - |  | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Collection is deemed probable: The Company conducts a credit review for all significant transactions at the time of the arrangement to determine the
credit-worthiness of the customer. Collection is deemed probable if the Company has a reasonable basis to expect that the customer will pay amounts under the arrangement as payments become due.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Deferred Revenue

Deferred
revenue consists primarily of payments received in advance of delivery of products and services associated with the sale of the Companys PLSP and EFE product offerings and service offerings. Deferred revenue also includes revenue related to
undelivered elements that may or may not have been sold in conjunction with the sale of the EEE product for which VSOE of the undelivered elements exists.

Research and Development

Research and development costs consist primarily of salaries and
other personnel-related costs, bonuses and facility costs. The Company maintains a research and development staff to enhance its products and to develop new products. In accordance with SFAS No. 86, Accounting for the Costs of Computer
Software to Be Sold, Leased, or Otherwise Marketed, software costs are expensed as incurred until technological feasibility of the software is determined and the recovery of the cost can reasonably be expected, after which any additional costs
are capitalized. The Company has expensed all software development costs because the establishment of technological feasibility of products and their availability for sale have substantially coincided.



F-11



---

##### Table of Contents

Commissions

The Company records sales commissions when the commissions are earned, which is generally when the customer has been billed and collection is probable. Related revenue is recognized as described above.

Leases

The Company leases it
facilities under operating leases, and accounts for those leases in accordance with SFAS No. 13, Accounting for Leases. For leases that contain rent escalation or rent concession provisions, the Company records the total rent
expense during the lease term on a straight-line basis over the term of the lease. The Company records the difference between the rent paid and the straight-line rent as a deferred rent liability in the accompanying consolidated balance sheets.

Advertising Costs

Advertising costs are charged to operations as incurred and were not significant for any period presented.

Income Taxes

On December 11, 2006, the Company filed an election to revoke its S Corporation status. From and after the termination of S
Corporation status, the Company is treated for federal and state income tax purposes as a C Corporation under Subchapter C of the Internal Revenue Code and, as a result, is subject to state and federal corporate income taxes. Prior to the
Companys revocation of its S Corporation status, the Company made no provision or liability for federal income taxes as the stockholders reported their proportionate share of the Companys taxable income on their individual income tax
returns. The Company is subject to income taxes in California, New York, New Jersey, Virginia, Texas and the United Kingdom and accordingly, a provision for these taxes is included in the accompanying financial statements.

Current income tax expense is the amount of income taxes paid or expected to be payable for the current year. Deferred income tax assets and liabilities
are computed annually for differences between the financial statement and income tax bases of assets and liabilities. Such deferred income tax asset and liability computations are based on enacted tax laws and rates applicable to periods in which
the differences are expected to reverse. If necessary, a valuation allowance is established to reduce deferred income tax assets to the amount expected to be realized.

Stock Split

On March 19, 2004, the Companys Board of Directors declared a
ten-for-one stock split of the Companys ordinary shares. Stockholders of record as of the close of business on March 19, 2004 received nine additional shares for each one share held on the record date with distribution of the additional
shares effected on March 19, 2004. Share, per share, and stock option data for all periods presented in the consolidated financial statements and related disclosures have been adjusted to give effect to the stock split.

Foreign Currency Transactions

Assets and liabilities denominated in foreign currencies are remeasured at the balance sheet date. Resulting exchange rate gains or losses are included as a component of current period earnings. No material gains or losses have been
incurred.

Commitments and Contingencies

The Company periodically evaluates all pending or threatened contingencies and any commitments, if any, that are reasonably likely to have a material adverse effect on its operations or financial position. The Company
assesses the probability of an adverse outcome and determines if it is remote, reasonably possible or probable as



F-12



---

##### Table of Contents

defined in accordance with the provisions of SFAS No. 5, Accounting for Contingencies. If information available prior to the issuance of the
Companys financial statements indicates that it is probable that an asset had been impaired or a liability had been incurred at the date of the Companys financial statements, and the amount of the loss, or the range of probable loss can
be reasonably estimated, then such loss is accrued and charged to operations. If no accrual is made for a loss contingency because one or both of the conditions pursuant to SFAS No. 5 are not met, but the probability of an adverse outcome is at
least reasonably possible, the Company will disclose the nature of the contingency and provide an estimate of the possible loss or range of loss, or state that such an estimate cannot be made.

Reclassifications

Certain
prior year amounts have been re-classified to confirm to the current year presentation. The Company has changed its classification of sponsorships earned from third parties from service revenue to a reduction of selling and marketing expenses. This
reclassification had no impact on operating or net income for the years ended 2004 and 2005, and the amounts reclassified were not material.

Prior to December 31, 2006, depreciation and amortization was allocated to each expense line in the statement of operations. For the year ended December 31, 2006, and all periods reported, depreciation and amortization is
presented as a single line in the financial statements. This reclassification had no impact on operating or net income for the years ended 2004 and 2005.

Recent Accounting Pronouncements

In February 2006, the FASB issued SFAS No. 155,
Accounting for Certain Hybrid Financial Instrumentsan amendment of FASB Statements No. 133 and 140, to simplify and make more consistent the accounting for certain financial instruments. Specifically, SFAS No. 155 amends
SFAS No. 133, Accounting for Derivative Instruments and Hedging Activities, to permit fair value remeasurement for any hybrid financial instrument with an embedded derivative that otherwise would require bifurcation, provided that
the whole instrument is accounted for on a fair value basis. SFAS No. 155 amends SFAS No. 140, Accounting for the Impairment or Disposal of Long-Lived Assets, to allow a qualifying special-purpose entity to hold a derivative
financial instrument that pertains to a beneficial interest other than another derivative financial instrument. SFAS No. 155 applies to all financial instruments acquired or issued after the beginning of an entitys first fiscal year that
begins after September 15, 2006, with earlier application allowed. The Company does not expect the adoption of SFAS No. 155 to have a significant impact on the consolidated results of operations or the financial position of the Company.

In June 2006, the FASB issued FASB Interpretation (FIN) No. 48, Accounting for Uncertainty in Income Taxesan
interpretation of FASB Statement No. 109. The interpretation clarifies the accounting for uncertainty in income taxes recognized in a companys financial statements in accordance with SFAS No. 109, Accounting for Income
Taxes. Specifically, the pronouncement prescribes a recognition threshold and a measurement attribute for the financial statement recognition and measurement of a tax position taken or expected to be taken in a tax return. The interpretation
also provides guidance on the related derecognition, classification, interest and penalties, accounting for interim periods, disclosure and transition of uncertain tax positions. This interpretation is effective for fiscal years beginning after
December 15, 2006. The cumulative effect of adopting FIN 48 will be recorded in retained earnings with a corresponding liability established for uncertain tax positions. The Company has not yet completed its evaluation of the impact of FIN 48
on its consolidated financial statements. The Company does, however, expect to record a cumulative effect adjustment to its 2007 balance of beginning accumulated deficit, and that adjustment may be material.

In September 2006, the FASB issued SFAS No. 157, Fair Value Measurements (SFAS 157). SFAS 157 does not require new fair
value measurements but rather defines fair value, establishes a framework for measuring fair value and expands disclosure of fair value measurements. SFAS 157 is effective for fiscal years beginning after November 15, 2007 and interim periods
within those fiscal years. The Company is currently assessing the impact of SFAS 157 on its consolidated financial position and results of operations.



F-13



---

##### Table of Contents

In February 2007, the FASB issued SFAS No. 159, The Fair Value Option for Financial Assets and
LiabilitiesIncluding an amendment of FASB Statement No. 115 (SFAS 159).SFAS 159 permits entities to choose to measure certain financial assets and liabilities at fair value (the fair value option).
Unrealized gains and losses, arising subsequent to adoption, are reported in earnings. SFAS 159 is effective for fiscal years beginning after November 15, 2007. The Company is required to adopt SFAS 159 in the first quarter of 2008. The Company
is currently assessing the impact of SFAS 159 on its consolidated financial statements.

Note 2.    Net (Loss) Income Per Share

The Company calculates (loss) net income per share in accordance with SFAS No. 128, Earnings Per Share. Under SFAS
No. 128, basic net income per common share is calculated by dividing net income by the weighted-average number of common shares outstanding during the reporting period. A reconciliation of the numerator and denominator used in the calculation
of basic and diluted net income (loss) per share is as follows:



|                                                                                        |  |                                       |        |   |      |   |        |  |   |        |  
|--------------------------------------------------------------------------------------- |  | ------------------------------------- | ------ | - | ---- | - | ------ |  | - | ------ | -
|                                                                                        |  | Years Ended December 31,              |       
|                                                                                        |  | 2004                                  |        |   | 2005 |   | 2006   | 
|                                                                                        |  | (in thousands, except per share data) |       
|Numerator:                                                                              |  |                                       |        |   |      |   |        |  |   |        |  
|Net (loss) income available to common stockholders                                      |  | $                                     | (792   | ) |      | $ | 1,616  |  | $ | (3,069 | )
|                                                                                        |  |                                       |        |   |      |   |        |  |   |        |  
|Denominator:                                                                            |  |                                       |        |   |      |   |        |  |   |        |  
|Weighted average shares used in computation of basic net (loss) income per share        |  |                                       | 19,431 |   |      |   | 20,412 |  |   | 19,530 |  
|Incremental shares required for diluted earnings per share:                             |  |                                       |        |   |      |   |        |  |   |        |  
|Common stock warrant                                                                    |  |                                       |       |   |      |   | 206    |  |   |       |  
|Stock options                                                                           |  |                                       |       |   |      |   | 405    |  |   |       |  
|                                                                                        |  |                                       |        |   |      |   |        |  |   |        |  
|Weighted average shares used in computation of diluted (loss) income per share-adjusted |  |                                       | 19,431 |   |      |   | 21,023 |  |   | 19,530 |  
|                                                                                        |  |                                       |        |   |      |   |        |  |   |        |  
|Basic net (loss) income per share                                                       |  | $                                     | (0.04  | ) |      | $ | 0.08   |  | $ | (0.16  | )
|                                                                                        |  |                                       |        |   |      |   |        |  |   |        |  
|Diluted net (loss) income per share                                                     |  | $                                     | (0.04  | ) |      | $ | 0.08   |  | $ | (0.16  | )
|                                                                                        |  |                                       |        |   |      |   |        |  |   |        |  

Diluted net income per common share reflects the effects of potentially dilutive securities, which
consist of stock options, and a warrant issued in connection with the private placement of common stock (see Note 13) for the year ended December 31, 2005. For the year ended December 31, 2004, weighted average shares of common stock
issuable in connection with stock options, a warrant and unvested restricted shares of 2,694,000 were not included in the diluted EPS calculation, as to do so would have been anti-dilutive. For the year ended December 31, 2006, weighted average
shares of common stock issuable in connection with stock options of 1,511,000 were not included in the diluted earnings per share calculation as to do so would have been anti-dilutive.

Note 3.    Fair Value of Investments in Marketable Debt Securities

The Company
has investments classified as available-for-sale securities categorized as follows:



|                                                                      |  |                  |       
|--------------------------------------------------------------------- |  | ---------------- | ------
|                                                                      |  | December 31,2006
|Type of Security:                                                     |  |                  |       
|U.S. Government debt securities with maturities of less than one year |  | $                | 24,694
|                                                                      |  |                  |       
|Total investments in marketable debt securities                       |  | $                | 24,694
|                                                                      |  |                  |       

Available-for sale securities are accounted for at fair value. Unrealized gains and losses on
these securities are reported as a separate component of stockholders equity. The company incurred gross unrealized losses of $17,000 related to the above investments. The Company determined that these investments are not deemed to be
other-than-temporarily impaired. The length of time that the investments have been in a continuous unrealized loss position at December 31, 2006 is not significant as the investments were purchased subsequent to the Companys initial
public offering in December 2006 (Note 11).



F-14



---

##### Table of Contents

|                                                                      |  |           |        |                  |   |     |  
|--------------------------------------------------------------------- |  | --------- | ------ | ---------------- | - | --- | -
|                                                                      |  | FairValue |        | UnrealizedLosses |  
|Type of Security:                                                     |  |           |        |                  |   |     |  
|U.S. Government debt securities with maturities of less than one year |  | $         | 24,694 |                  | $ | (17 | )
|                                                                      |  |           |        |                  |   |     |  
|Total investments in marketable debt securities                       |  | $         | 24,694 |                  | $ | (17 | )
|                                                                      |  |           |        |                  |   |     |  

Note 4.    Property and Equipment

Property and equipment, including assets held under capital leases as described in Note 8, consist of the following:



|                                           |  |                          |        |   |      |   |        |  
|------------------------------------------ |  | ------------------------ | ------ | - | ---- | - | ------ | -
|                                           |  | Years Ended December 31, |       
|                                           |  | 2005                     |        |   | 2006 |  
|                                           |  | (in thousands)           |       
|Leasehold improvements                     |  | $                        | 1,114  |   |      | $ | 1,960  |  
|Equipment and furniture                    |  |                          | 3,347  |   |      |   | 5,705  |  
|Leased equipment                           |  |                          | 1,683  |   |      |   | 2,180  |  
|Assets not yet placed in service           |  |                          |       |   |      |   | 1,429  |  
|                                           |  |                          |        |   |      |   |        |  
|                                           |  |                          | 6,144  |   |      |   | 11,274 |  
|Accumulated depreciation                   |  |                          | (2,355 | ) |      |   | (3,618 | )
|Accumulated amortization, leased equipment |  |                          | (950   | ) |      |   | (1,130 | )
|                                           |  |                          |        |   |      |   |        |  
|Property and equipment, net                |  | $                        | 2,839  |   |      | $ | 6,526  |  
|                                           |  |                          |        |   |      |   |        |  

Depreciation and amortization expense related to property and equipment was $1,158,000,
$1,357,000, and $1,823,000 for the years ended December 31, 2004, 2005, and 2006, respectively.

Note 5.    Income Taxes

On December 11, 2006 the Company terminated its status as an S Corporation for U.S. federal income tax purposes. As a result, the
Company will be treated as a C Corporation and be subject to state and federal income taxes. On December 12, 2006, as a result of this termination, the Company recorded additional deferred tax assets in the amount of $2,261,000, comprised
primarily of timing differences related to deferred revenues and accrued expenses. Concurrently, the valuation allowance was increased by $2,261,000 to reduce the carrying value of the deferred tax asset to zero.

The provision for income taxes consists of the following:



|                    |  |                         |     |   |      |   |     |      |  |   |        |  
|------------------- |  | ----------------------- | --- | - | ---- | - | --- | ---- |  | - | ------ | -
|                    |  | Year Ended December 31, |    
|                    |  | 2004                    |     |   | 2005 |   |     | 2006 | 
|                    |  | (in thousands)          |    
|Current:            |  |                         |     |   |      |   |     |      |  |   |        |  
|Federal             |  | $                       |    |   |      | $ |    |      |  | $ |       |  
|State               |  |                         | 10  |   |      |   | 13  |      |  |   | 39     |  
|                    |  |                         |     |   |      |   |     |      |  |   |        |  
|                    |  |                         | 10  |   |      |   | 13  |      |  |   | 39     |  
|Deferred:           |  |                         |     |   |      |   |     |      |  |   |        |  
|Federal             |  |                         |    |   |      |   |    |      |  |   | (2,207 | )
|State               |  |                         | (70 | ) |      |   | (45 | )    |  |   | (286   | )
|                    |  |                         |     |   |      |   |     |      |  |   |        |  
|                    |  |                         | (70 | ) |      |   | (45 | )    |  |   | (2,493 | )
|Valuation allowance |  |                         | 70  |   |      |   | 45  |      |  |   | 2,493  |  
|                    |  |                         |     |   |      |   |     |      |  |   |        |  
|                    |  | $                       | 10  |   |      | $ | 13  |      |  | $ | 39     |  
|                    |  |                         |     |   |      |   |     |      |  |   |        |  



F-15



---

##### Table of Contents

A reconciliation of the provision for income taxes at the federal statutory rate compared to the
Companys actual tax provision is as follows:



|                                                                            |  |                   |        |  
|--------------------------------------------------------------------------- |  | ----------------- | ------ | -
|                                                                            |  | December 31, 2006 |       
|                                                                            |  | (in thousands)    |       
|Federal Income Tax Benefit at Statutory Rate                                |  | $                 | (1,031 | )
|State Income Taxes, net of federal benefit                                  |  |                   | (146   | )
|Tax Benefit not realizable due to S-Corporation status                      |  |                   | 974    |  
|Recognition of deferred tax assets upon termination of S-corporation status |  |                   | (2,261 | )
|Valuation allowance increased upon termination of S-Corporation status      |  |                   | 2,261  |  
|Change in valuation allowance affecting income tax expense                  |  |                   | 181    |  
|Other                                                                       |  |                   | 61     |  
|                                                                            |  |                   |        |  
|                                                                            |  | $                 | 39     |  
|                                                                            |  |                   |        |  

The components of deferred tax assets and liabilities are as follows:



|                                                     |  |                          |      |   |      |   |        |  
|---------------------------------------------------- |  | ------------------------ | ---- | - | ---- | - | ------ | -
|                                                     |  | Years Ended December 31, |     
|                                                     |  | 2005                     |      |   | 2006 |  
|                                                     |  | (in thousands)           |     
|Depreciable assets                                   |  | $                        | (9   | ) |      | $ | (291   | )
|Accrued expenses                                     |  |                          | 24   |   |      |   | 1,156  |  
|Deferred revenue                                     |  |                          | 75   |   |      |   | 1,735  |  
|Other accruals and reserves                          |  |                          | 20   |   |      |   | 58     |  
|Tax credits                                          |  |                          | 176  |   |      |   | 23     |  
|Net operating losses                                 |  |                          |     |   |      |   | 98     |  
|                                                     |  |                          |      |   |      |   |        |  
|Net deferred tax assets prior to valuation allowance |  |                          | 286  |   |      |   | 2,779  |  
|Valuation allowance                                  |  |                          | (286 | ) |      |   | (2,779 | )
|                                                     |  |                          |      |   |      |   |        |  
|Net deferred tax assets                              |  | $                        |     |   |      | $ |       |  
|                                                     |  |                          |      |   |      |   |        |  

In assessing the realizability of the net deferred tax assets, management considers whether it is
more likely than not that some or all of the deferred tax assets will not be realized. The ultimate realization of deferred tax assets depends upon either the generation of future taxable income during the periods in which those temporary
differences become deductible or the carryback of losses to recover income taxes previously paid during the carryback period. As of December 31, 2006, the Company had provided a full valuation allowance to reduce net deferred tax assets to
zero.

At December 31, 2006 the Company had federal and state net operating loss carryforwards of approximately $255,000 and $253,000,
respectively. If not previously utilized, the federal and state net operating loss carryforwards begin to expire in 2026 and 2016, respectively.

At December 31, 2006 the Company had federal and state research and development credit carryforwards of approximately $14,000 and $9,000, respectively. The federal research and development credit carryforwards begin to expire in 2026,
if not previously utilized. The state research and development credit carryforwards have no expiration date.

Note 6.    Debt
Obligations

The Company maintains a revolving line of credit with a bank which expires on October 31, 2007. Borrowing capacity
under the line of credit was at $3,000,000 and $2,000,000 at December 31, 2006 and 2005, respectively. Borrowings under the line of credit bear interest at a rate equal to the banks prime rate minus



F-16



---

##### Table of Contents

0.25% or the banks LIBOR plus 2.25% (7.57% and 6.75% at December 31, 2006 and 2005, respectively). Any borrowings made under the line are
collateralized by substantially all the assets of the Company. At December 31, 2006 and 2005, no amounts were outstanding under the line.

Covenants in connection with the line of credit impose restrictions and requirements related to, among other things, maintenance of certain financial ratios and limitations on outside indebtedness. As of December 31, 2006, the Company
was in violation of certain financial covenants, which included a requirement to maintain a minimum of $1.0 million of earnings before interest, taxes, depreciation and amortization at the end of each fiscal quarter (calculated using the current
quarter just ended and the preceding three fiscal quarters), and a minimum effective tangible net worth at all times equal to or greater than 75% of the net proceeds from the sale of any of our equity interests plus 50% of annual net income. Minimum
effective tangible net worth is defined as stated net worth plus our subordinated debt and less intangible assets. (see Note 19).

On
November 20, 2006, the Company entered into a fourth amendment to its revolving line of credit amending certain covenants. The new covenants include, among other requirements, a requirement to complete an initial public offering resulting in
proceeds of at least $20 million by January 31, 2007.

On November 24, 2006, the Company entered into an irrevocable standby
letter-of-credit with a bank for $225,000 which expires on November 17, 2015. This letter-of-credit provides collateral for office space leased by the Company in New York.

The Company had an irrevocable standby letter-of-credit agreement for $75,000 which expired on August 31, 2005. This letter of credit provided
collateral for the Companys former corporate facility lease.

Note 7.    Related Party Transactions

Certain stockholders of the Company guarantee substantially all of the obligations due under the capital leases and operating leases (Note 8).

Note 8.    Leases

The Company
leases certain of its operating facilities under noncancelable operating leases extending through 2015. The Company also leases certain equipment under capital leases extending through 2011. The Company also subleases certain of its facilities under
non-cancellable operating leases. The present value of the remaining future minimum lease payments is recorded as capital leases in the consolidated balance sheet. The following is a schedule of future minimum lease payments under capital leases,
operating leases and future noncancellable sublease income:



|                                                 |  |                                     |       |   |                                       |   |                                      |  |   |                                 |   |  |   |       
|------------------------------------------------ |  | ----------------------------------- | ----- | - | ------------------------------------- | - | ------------------------------------ |  | - | ------------------------------- | - |  | - | ------
|Years Ending December 31,                        |  | Future MinimumCapital LeasePayments |       |   | Future MinimumOperating LeasePayments |   | FutureNon-CancellableSublease Income |  |   | Net FutureMinimum LeasePayments
|                                                 |  | (in thousands)                     
|2007                                             |  | $                                   | 942   |   |                                       | $ | 2,840                                |  | $ | (54                             | ) |  | $ | 3,728 
|2008                                             |  |                                     | 504   |   |                                       |   | 3,032                                |  |   |                                |   |  |   | 3,536 
|2009                                             |  |                                     | 102   |   |                                       |   | 2,887                                |  |   |                                |   |  |   | 2,989 
|2010                                             |  |                                     | 10    |   |                                       |   | 2,810                                |  |   |                                |   |  |   | 2,820 
|2011                                             |  |                                     | 4     |   |                                       |   | 2,882                                |  |   |                                |   |  |   | 2,886 
|Thereafter                                       |  |                                     |      |   |                                       |   | 6,554                                |  |   |                                |   |  |   | 6,554 
|                                                 |  |                                     |       |   |                                       |   |                                      |  |   |                                 |   |  |   |       
|Total                                            |  |                                     | 1,562 |   |                                       | $ | 21,005                               |  | $ | (54                             | ) |  | $ | 22,513
|                                                 |  |                                     |       |   |                                       |   |                                      |  |   |                                 |   |  |   |       
|Less amounts representing interest (5.5%  9.1%) |  |                                     | (132  | ) |                                       |   |                                      |  |   |                                 |   |  |   |       
|                                                 |  |                                     |       |   |                                       |   |                                      |  |   |                                 |   |  |   |       
|                                                 |  | $                                   | 1,430 |   |                                       |   |                                      |  |   |                                 |   |  |   |       
|                                                 |  |                                     |       |   |                                       |   |                                      |  |   |                                 |   |  |   |       



F-17



---

##### Table of Contents

Rent expense related to operating leases for 2004, 2005, and 2006 was $1,689,000, $1,592,000, and
$2,543,000 respectively. Sublease rental income for the years ended December 31, 2004, 2005, and 2006 was $141,000, $126,000, and $123,000, respectively. Substantially all of the capital leases and one operating lease are guaranteed by certain
stockholders of the Company.

Note 9.    Stock Option Plan and Employee Benefit Plan

In 2004, the Companys Board of Directors and stockholders approved the 2004 Equity Incentive Plan (the Plan). A total of 2,062,000
shares of common stock was initially authorized and reserved for issuance under the Plan in the form of incentive and non-qualified stock options and restricted stock. The Plan was amended in 2005 to increase to 3,977,000 the number of shares
available for issuance. On May 3, 2006, the Companys Board of Directors and its stockholders approved increases in the shares available for issuance under the Plan by an additional 1,127,000 shares on May 3, 2006, an additional
828,000 shares on January 1, 2007, an additional 828,000 shares on January 1, 2008 and an additional 828,000 shares on January 1, 2009. Employees, officers and directors are eligible under the Plan, which is administered by the
Companys Board of Directors, who determines the terms and conditions of each grant. The terms of the options granted under the Plan are determined at the time of grant, and generally vest 25% annually over a four-year period and typically must
be exercised within 10 years from the date of grant. The options prices are determined by the Companys Board of Directors.

A summary
of the Companys stock option activity follows:



|                               |  |                  |   |  |                              |      |                        |   |             
|------------------------------ |  | ---------------- | - |  | ---------------------------- | ---- | ---------------------- | - | ------------
|                               |  | Number ofOptions |   |  | WeightedAverageExercisePrice |      | Range ofExercise Price
|Outstanding, January 1, 2004   |  |                 |   |  | $                            |     |                        | $ |            
|Granted                        |  | 1,567,000        |   |  |                              | 4.54 |                        |   | 4.54        
|Exercised                      |  |                 |   |  |                              |     |                        |   |            
|Canceled or forfeited          |  | (105,000         | ) |  |                              | 4.54 |                        |   | 4.54        
|                               |  |                  |   |  |                              |      |                        |   |             
|Outstanding, December 31, 2004 |  | 1,462,000        |   |  |                              | 4.54 |                        |   | 4.54        
|Granted                        |  | 1,971,000        |   |  |                              | 4.84 |                        |   | 4.54-6.32   
|Excercised                     |  |                 |   |  |                              |     |                        |   |            
|Canceled or forfeited          |  | (104,000         | ) |  |                              | 4.73 |                        |   | 4.54 - 6.32 
|                               |  |                  |   |  |                              |      |                        |   |             
|Outstanding, December 31, 2005 |  | 3,329,000        |   |  |                              | 4.71 |                        |   | 4.54 -6.32  
|Granted                        |  | 1,346,000        |   |  |                              | 9.29 |                        |   | 6.37 - 11.90
|Exercised                      |  | (360,000         | ) |  |                              | 4.58 |                        |   | 4.54 - 6.17 
|Canceled or forfeited          |  | (411,000         | ) |  |                              | 5.02 |                        |   | 4.54 - 11.90
|                               |  |                  |   |  |                              |      |                        |   |             
|Outstanding, December 31, 2006 |  | 3,904,000        |   |  | $                            | 6.26 |                        | $ | 4.54 - 11.90
|                               |  |                  |   |  |                              |      |                        |   |             

A summary of the status of the Companys non-vested shares as of December 31, 2006, and
the changes during the year ended December 31, 2006 is presented below:



|                                          |  |                   |   |  |                                        
|----------------------------------------- |  | ----------------- | - |  | ---------------------------------------
|                                          |  | Number of Options |   |  | Weighted AverageGrant DateFair Value(1)
|Nonvested options as of January 1, 2006   |  | 2,977,000         |   |  |                                       
|Granted                                   |  | 1,346,000         |   |  | 6.67                                   
|Vested                                    |  | (933,000          | ) |  |                                       
|Forfeited                                 |  | (411,000          | ) |  |                                       
|                                          |  |                   |   |  |                                        
|Nonvested options as of December 31, 2006 |  | 2,979,000         |   |  |                                       
|                                          |  |                   |   |  |                                        

---

|(1) | During the year ended December 31, 2005, the Company used the minimum-value method afforded by SFAS No. 123 (SFAS 123) Accounting for Stock-Based
Compensation, for disclosure purposes. Accordingly, fair value information for options granted in this period is not available.
|--- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



F-18



---

##### Table of Contents

The following table summarizes information about stock options outstanding at December 31, 2006:



|               |  |                     |  |                                              |  |                               |       |                 |   |                  |  |                                              |  |                               |  |                 |       |  |   |           
|-------------- |  | ------------------- |  | -------------------------------------------- |  | ----------------------------- | ----- | --------------- | - | ---------------- |  | -------------------------------------------- |  | ----------------------------- |  | --------------- | ----- |  | - | ----------
|               |  | Options Outstanding |  | Options Exercisable                         
|Exercise Price |  | Number ofOptions    |  | WeightedAverageRemainingContractLife (Years) |  | WeightedAverageExercise Price |       | Intrinsic Value |   | Number ofOptions |  | WeightedAverageRemainingContract Life(Years) |  | WeightedAverageExercise Price |  | Intrinsic Value
|$  4.54        |  | 2,237,000           |  | 7.76                                         |  | $                             | 4.54  |                 | $ | 24,674,000       |  | 828,000                                      |  | 7.76                          |  | $               | 4.54  |  | $ | 9,133,000 
|$  5.34        |  | 180,000             |  | 8.36                                         |  |                               | 5.34  |                 |   | 1,841,000        |  | 45,000                                       |  | 8.36                          |  |                 | 5.34  |  |   | 460,000   
|$  6.17        |  | 134,000             |  | 8.64                                         |  |                               | 6.17  |                 |   | 1,260,000        |  | 34,000                                       |  | 8.64                          |  |                 | 6.17  |  |   | 320,000   
|$  6.32        |  | 71,000              |  | 8.88                                         |  |                               | 6.32  |                 |   | 657,000          |  | 18,000                                       |  | 8.88                          |  |                 | 6.32  |  |   | 167,000   
|$  6.37        |  | 403,000             |  | 9.15                                         |  |                               | 6.37  |                 |   | 3,708,000        |  |                                             |  |                              |  |                 | 6.37  |  |   |          
|$  7.64        |  | 69,000              |  | 9.34                                         |  |                               | 7.64  |                 |   | 547,000          |  |                                             |  |                              |  |                 | 7.64  |  |   |          
|$10.75         |  | 580,000             |  | 9.58                                         |  |                               | 10.75 |                 |   | 2,796,000        |  |                                             |  |                              |  |                 | 10.75 |  |   |          
|$11.90         |  | 230,000             |  | 9.85                                         |  |                               | 11.90 |                 |   | 844,000          |  |                                             |  |                              |  |                 | 11.90 |  |   |          
|               |  |                     |  |                                              |  |                               |       |                 |   |                  |  |                                              |  |                               |  |                 |       |  |   |           
|               |  | 3,904,000           |  | 8.41                                         |  | $                             | 6.26  |                 | $ | 36,327,000       |  | 925,000                                      |  | 7.84                          |  | $               | 4.64  |  | $ | 10,080,000
|               |  |                     |  |                                              |  |                               |       |                 |   |                  |  |                                              |  |                               |  |                 |       |  |   |           



|               |  |                          |  |                                              |  |                               |       |                 |   |           
|-------------- |  | ------------------------ |  | -------------------------------------------- |  | ----------------------------- | ----- | --------------- | - | ----------
|               |  | Options Expected to Vest
|Exercise Price |  | Number ofOptions         |  | WeightedAverageRemainingContractLife (Years) |  | WeightedAverageExercise Price |       | Intrinsic Value
|$  4.54        |  | 1,275,000                |  | 7.76                                         |  | $                             | 4.54  |                 | $ | 14,063,000
|$  5.34        |  | 122,000                  |  | 8.36                                         |  |                               | 5.34  |                 |   | 1,248,000 
|$  6.17        |  | 91,000                   |  | 8.64                                         |  |                               | 6.17  |                 |   | 855,000   
|$  6.32        |  | 48,000                   |  | 8.88                                         |  |                               | 6.32  |                 |   | 444,000   
|$  6.37        |  | 365,000                  |  | 9.15                                         |  |                               | 6.37  |                 |   | 3,358,000 
|$  7.64        |  | 62,000                   |  | 9.34                                         |  |                               | 7.64  |                 |   | 492,000   
|$10.75         |  | 525,000                  |  | 9.58                                         |  |                               | 10.75 |                 |   | 2,531,000 
|$11.90         |  | 208,000                  |  | 9.85                                         |  |                               | 11.90 |                 |   | 763,000   
|               |  |                          |  |                                              |  |                               |       |                 |   |           
|               |  | 2,696,000                |  | 8.58                                         |  | $                             | 8.41  |                 | $ | 23,754,000
|               |  |                          |  |                                              |  |                               |       |                 |   |           

The Company defines in-the-money options at December 31, 2006 as options that had exercise
prices that were lower than the $15.57 fair market value of its common stock at that date. The aggregate intrinsic value of options outstanding at December 31, 2006 is calculated as the difference between the exercise price of the underlying
options and the fair market value of the Companys common stock for the 3,904,000 shares that were in-the-money at that date. There were 925,000 in-the-money options exercisable at December 31, 2006. The total intrinsic value of the
options exercised during the year ended December 31, 2006 was $2,320,000, determined as of the date of exercise.

As of
December 31, 2005, the number of options exercisable was 1,016,000 and the weighted average exercise price of those options was $4.54. There were no shares exercisable at December 31, 2004.

A total of 840,000 options remain available for grant under the Companys Plan at December 31, 2006.

The Company has a 401(k) plan that allows all full-time eligible employees to contribute up to 15% of their annual compensation, subject to certain
limitations. After one year of service, the Company will match 50% of the first 6% for each employees contribution, and may, at its discretion, make additional contributions regardless of profitability. The Companys contribution related
expense was $167,000, $267,000, and $425,000 in the years ended 2004, 2005, and 2006, respectively.



F-19



---

##### Table of Contents

In April 2005, the Companys Board of Directors and stockholders approved the Executive Retention
and Severance Plan (ERS) to promote the interests of the Company and its stockholders by attracting and retaining executive personnel and other key employees of the Company. The ERS is designed to provide certain executive personnel with
specified compensation and benefits in the event of a change in control, as defined in the ERS, or termination of employment under certain circumstances. At December 31, 2006 total severance obligations in connection with these employment
contracts amounted to $2,530,000.

The Company has a profit sharing plan for its employees whereby eligible employees may receive a
discretionary amount of the Companys operating profits as defined. For the years ended December 31, 2004, 2005 and 2006, the amount paid or accrued by the Company to its employees was $321,000, $1,189,000 and $312,000, respectively.

Note 10.    Share-Based Compensation

Prior to January 1, 2006, the Company accounted for the stock options granted under the Plan by applying the intrinsic value-based method of accounting prescribed by Accounting Principles Board Opinion
No. 25 (APB 25), Accounting for Stock Issued to Employees. Under this method, compensation expense is generally recorded over the vesting period, only if the fair value of the underlying stock exceeded the exercise price
on the grant date. The Company adopted the disclosure-only requirements of SFAS No. 123 (SFAS 123) Accounting for Stock-Based Compensation, and SFAS No. 148 (SFAS 148), Accounting for Stock-Based
CompensationTransition and Disclosurean Amendment of FASB Statement No. 123. These statements established accounting and disclosure requirements using a fair value-based method of accounting for share-based employee
compensation plans. As allowed by SFAS 123 and SFAS 148, the Company elected to continue to apply the intrinsic value-based method described above. Accordingly, no share-based compensation for stock options is recorded in the accompanying financial
statements prior to January 1, 2006, as the fair-value of the underlying stock did not exceed the exercise price of the options at the date of grant.

Effective January 1, 2006, the Company adopted SFAS No. 123R (SFAS 123R) Share-Based Payment. Prior to the adoption of SFAS 123R, the Company used the minimum-value method afforded by
SFAS 123 for disclosure purposes; therefore, as prescribed by SFAS 123R, the Company adopted SFAS 123R using the prospective transition method. Accordingly, prior period amounts have not been restated. Under this transition method, compensation cost
in 2006 includes the portion related to options vesting in the period for (1) all share-based payments granted prior to, but not vested as of January 1, 2006, based on the grant date intrinsic value of the option estimated in accordance
with the provisions of APB 25 and (2) all share-based payments granted subsequent to January 1, 2006, based on the grant date fair value estimated in accordance with the provisions of SFAS 123R. However, as described above, no share-based
compensation was recorded related to options granted prior to January 1, 2006, as the fair-value of the underlying stock did not exceed the exercise price of the options at the date of grant.

The fair values of each award granted under the Plan during the year ended December 31, 2006 were estimated at the date of grant using the
Black-Scholes option pricing model and the following weighted average assumptions:



|                        |  |                             |  
|----------------------- |  | --------------------------- | -
|                        |  | Year EndedDecember 31, 2006 |  
|Risk-free interest rate |  | 4.60                        | %
|Dividend yield          |  |                            | %
|Expected life (years)   |  | 6.25                        |  
|Volatility              |  | 72.8                        | %

In March 2005, the Securities and Exchange Commission (SEC) issued Staff Accounting
Bulletin Topic No. 107 (SAB 107) which provides guidance on the implementation of SFAS 123R. The Company applied the principles of SAB 107 in conjunction with its adoption of SFAS 123R. The volatility of the Companys common



F-20



---

##### Table of Contents

stock is estimated at the date of grant based on the equally weighted-average of the implied volatility of publicly traded 30-day to 270-day options on the
common stock of a select peer group of similar companies (Similar Companies) and the historical volatility of the common stock of Similar Companies, consistent with the requirements of SFAS 123R and SAB 107. The risk-free interest rate
that was used in the Black-Scholes option valuation model is based on the implied yield in effect at the time of each option grant, based on U.S. Treasury zero-coupon issues with equivalent remaining terms. Management uses an expected dividend yield
of zero in the Black-Scholes option valuation model, as it has no intention to pay any cash dividends on its common stock in the foreseeable future. SFAS 123R requires management to estimate forfeitures at the time of grant and revise those
estimates in subsequent periods if actual forfeitures differ from those estimates. Management uses historical data to estimate pre-vesting option forfeitures and records share-based compensation expense only for those awards that are expected to
vest. The Company amortizes share-based compensation on a straight-line basis. All options are amortized over the requisite service period of the awards, which is generally the vesting period. The expected term of stock option awards granted was
calculated using the simplified method as defined by SAB 107 as the Company lacks historical data and is unable to make reasonable expectations regarding the future. The weighted average estimated grant date fair value for options
granted under the Companys stock option plan during the year ended December 31, 2006 was $6.67 per option.

As of
December 31, 2006, there was $7.0 million of total unrecognized compensation cost related to non-vested share-based compensation that is expected to be recognized over a weighted-average period of 3.78 years. We expect to record approximately
$2.5 million in additional share-based compensation in the year ended December 31, 2007 related to options outstanding at December 31, 2006.

In July 2001, the Company granted restricted common shares to certain key employees. Share-based compensation recorded in the statement of operations was $108,000 for the year ended December 31, 2004.

Note 11.    Initial Public Offering

In December 2006, the Company completed its initial public offering through the sale of 5,750,000 shares of common stock at $11.50 per share. Of the shares sold in the initial public offering, 3,250,000 shares were primary shares sold by
the Company and 2,500,000 shares were secondary and sold by selling stockholders, including the underwriters exercise of an over-allotment option to purchase up to 750,000 shares from a selling stockholder. A total of $37,375,000 in gross
proceeds were raised in the initial public offering. After deducting the underwriting discount of $2,617,000, net proceeds received by the Company were $34,759,000. The Company incurred $4,213,000 in costs related to the initial public offering
which were recorded as a reduction of additional paid in capital.

Note 12.    Preferred stock

In conjunction with the re-incorporation of the Company in the State of Delaware (Note 1), the amended and restated certificate of incorporation
authorizes the board of directors, subject to limitations prescribed by law, to issue up to 10,000,000 shares of preferred stock in one or more series without approval by common shareholders. The rights, preferences, privileges, and restrictions of
the shares are set by the board of directors at the time of issuance. No preferred stock is outstanding at December 31, 2006.

Note
13.    Private Placement of Common Stock and Warrant to Purchase Stock

In connection with hiring an executive
officer, the Company entered into a stock purchase agreement (Agreement) on September 6, 2003 with a family member of such officer (Investor) pursuant to which the Company sold the Investor 412,390 shares of common stock
and a warrant for an aggregate purchase price of $2,250,000. There were no significant costs incurred in connection with the sale.

The
term of the warrant was 39 months and was exercised by the Investor on July 1, 2006 for 206,200 shares of common stock. The related proceeds were not material.



F-21



---

##### Table of Contents

Note 14.    Contribution of Common Stock

On May 2, 2006, the Companys founding stockholders contributed 2,062,000 common shares to the Company. The contribution was made as a result of
a commitment by the founding stockholders, upon establishment of the 2004 Equity Incentive Plan, to fund the common shares underlying the initial 2,062,000 option grants. Upon receipt of the contribution, the Company retired the common shares. The
contribution and related retirement is reflected as a contribution of common stock by stockholder and retirement in the Consolidated Statements of Stockholders Equity.

Note 15.    Contingencies

Federal Trade Commission Inquiry

In early January 2006, the Federal Trade Commission (FTC) commenced an inquiry into a network security breach at the Company. The Company
recorded an accrual of $500,000 with an offsetting charge to general and administrative expense as of and for the year ended December 31, 2005. On September 20, 2006, we executed a consent decree proposed by the FTC that requires, among
other activities, that we provide biennial third-party assessments of our information technology security for a period of 10 years. The Company incurred $290,000 of costs associated with this matter during the year ended December 31, 2006. As a
result of the consent decree, the Company reversed $115,000 of the related accrual with an offsetting credit to general and administrative expense during the year ended December 31, 2006. As of December 31, 2006, $85,000 remains accrued.

In addition, several customers who were notified of the security breach have sought compensation, which in each case has been satisfied by
payment of amounts that are not material to the Company, and one customer has commenced litigation, which was dismissed by a federal court and subsequently settled with the customer. Additionally, we have paid approximately $11,500 in fines to
credit card processing companies through December 31, 2006.

The Company may face additional legal and administrative action with
respect to the security breach. In addition, the Company is subject to legal proceedings, claims, and litigation arising in the ordinary course of business. While the outcome of these matters is not currently determinable, the Company does not
expect that the ultimate costs to resolve these matters will have a material effect on the Companys consolidated financial position, results of operations, or cash flows, other than as disclosed.

Indemnification

The Company has agreed to
indemnify its directors and executive officers for costs associated with any fees, expenses, judgments, fines and settlement amounts incurred by them in any action or proceeding to which any of them is, or is threatened to be, made a party by reason
of his or her services as the Companys director or officer.

Tax Matters Agreement

The Company has agreed to indemnify the pre-initial public offering stockholders for any increases in their tax liability for the periods during which the
Company was an S Corporation.

Legal Matters

We are from time to time a party to legal proceedings that arise in the normal course of business. We are not currently involved in any litigation, the outcome of which would, in managements judgment based on
information currently available, have a material adverse effect on our results of operations or financial condition, nor is management aware of any such litigation threatened against us.



F-22



---

##### Table of Contents

Note 16.    Segment Information

The Company has adopted SFAS No. 131, Disclosures about Segments of an Enterprise and Related Information. This standard requires
segmentation based on the Companys internal organization and reporting of revenue and other performance measures. The Companys segments are designed to allocate resources internally and provide a framework to determine management
responsibility. Operating segments are defined as components of an enterprise about which discrete financial information is available that is evaluated regularly by the chief operating decision maker, or decision making group, in deciding how to
allocate resources and in assessing performance. Our chief operating decision maker is our Chief Executive Officer. The Company has four operating segments. The types of products and services provided by each segment are summarized below:



| |  |  | Products segmentincludes EEE solutions, EFE solutions, PLSP solutions and hardware sales.
| | - |  | ------------------------------------------------------------------------------------------



| |  |  | Professional services segmentis our division that performs consulting services and implementations. Consulting services include conducting investigations
using our software products.
| | - |  | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Training segmentis our division that provides in-house training classes in which we train our customers to effectively and efficiently use our software
products.
| | - |  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------



| |  |  | Maintenance segmentMaintenance (as defined in Note 1) related revenue and costs.
| | - |  | ---------------------------------------------------------------------------------

We refer to the revenue generated by our professional services and training segments, collectively, as services revenue. We refer to the revenue
generated by our training segment as training revenue. We refer to the revenue generated by our maintenance segment as maintenance revenue.

Currently, the Company does not separately allocate operating expenses to these segments, nor does it allocate specific assets to these segments. Therefore, the segment information reported includes only revenues, cost of revenues and gross
profit. The following tables present the operations by each operating segment:



|                              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  
|----------------------------- |  | ---------------------------- | ------ | -------------------- | - | ----- | -------- |  | ------------------ | ----- | ----- | - | ----- |  | - | ------ | -
|                              |  | Year Ended December 31, 2004 |       
|                              |  | Product                      |        | ProfessionalServices |   |       | Training |  | Maintenance& Other |       | Total |  
|                              |  | (in thousands)               |       
|Revenues                      |  | $                            | 15,812 |                      | $ | 3,032 |          |  | $                  | 6,116 |       | $ | 2,644 |  | $ | 27,604 |  
|Cost of revenues              |  |                              | 1,685  |                      |   | 3,812 |          |  |                    | 3,524 |       |   | 595   |  |   | 9,615  |  
|                              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  
|Gross profit                  |  | $                            | 14,127 |                      | $ | (780  | )        |  | $                  | 2,592 |       | $ | 2,049 |  |   | 17,989 |  
|                              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  
|Operating expenses:           |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  
|Selling and marketing         |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | 10,461 |  
|Research and development      |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | 3,295  |  
|General and administrative    |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | 3,894  |  
|Depreciation and amortization |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | 1,158  |  
|                              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  
|Total operating expenses      |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | 18,808 |  
|                              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  
|Operating loss                |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | (819   | )
|Interest income               |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | 3      |  
|Interest expense              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | (112   | )
|Other income, net             |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   | 146    |  
|                              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  
|Loss before income taxes      |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  | $ | (782   | )
|                              |  |                              |        |                      |   |       |          |  |                    |       |       |   |       |  |   |        |  



F-23



---

##### Table of Contents

|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|----------------------------- |  | ---------------------------- | ------ | -------------------- | - | -------- |  | ------------------ | ----- | ----- | - | ----- |  | - | ------ | -
|                              |  | Year Ended December 31, 2005 |       
|                              |  | Product                      |        | ProfessionalServices |   | Training |  | Maintenance& Other |       | Total |  
|                              |  | (in thousands)               |       
|Revenues                      |  | $                            | 23,138 |                      | $ | 5,144    |  | $                  | 6,705 |       | $ | 4,518 |  | $ | 39,505 |  
|Cost of revenues              |  |                              | 2,202  |                      |   | 4,373    |  |                    | 4,000 |       |   | 773   |  |   | 11,348 |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Gross profit                  |  | $                            | 20,936 |                      | $ | 771      |  | $                  | 2,705 |       | $ | 3,745 |  |   | 28,157 |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Operating expenses:           |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Selling and marketing         |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 15,691 |  
|Research and development      |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 4,680  |  
|General and administrative    |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 4,923  |  
|Depreciation and amortization |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 1,357  |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Total operating expenses      |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 26,651 |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Operating income              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 1,506  |  
|Interest income               |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 54     |  
|Interest expense              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | (81    | )
|Other income, net             |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 150    |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Income before income taxes    |  |                              |        |                      |   |          |  |                    |       |       |   |       |  | $ | 1,629  |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  



|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|----------------------------- |  | ---------------------------- | ------ | -------------------- | - | -------- |  | ------------------ | ----- | ----- | - | ----- |  | - | ------ | -
|                              |  | Year Ended December 31, 2006 |       
|                              |  | Product                      |        | ProfessionalServices |   | Training |  | Maintenance& Other |       | Total |  
|                              |  |                              |       
|Revenues                      |  | $                            | 32,565 |                      | $ | 8,822    |  | $                  | 6,976 |       | $ | 7,502 |  | $ | 55,865 |  
|Cost of revenues              |  |                              | 2,429  |                      |   | 7,671    |  |                    | 4,981 |       |   | 987   |  |   | 16,068 |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Gross profit                  |  | $                            | 30,136 |                      | $ | 1,151    |  | $                  | 1,995 |       | $ | 6,515 |  |   | 39,797 |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Operating expenses:           |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Selling and marketing         |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 26,238 |  
|Research and development      |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 7,113  |  
|General and administrative    |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 7,840  |  
|Depreciation and amortization |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 1,823  |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Total operating expenses      |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 43,014 |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Operating loss                |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | (3,217 | )
|Interest income               |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 105    |  
|Interest expense              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | (91    | )
|Other income, net             |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   | 173    |  
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  
|Loss before income taxes      |  |                              |        |                      |   |          |  |                    |       |       |   |       |  | $ | (3,030 | )
|                              |  |                              |        |                      |   |          |  |                    |       |       |   |       |  |   |        |  

Revenue, classified by the major geographic areas in which the Company operates, is as follows:



|         |  |                         |        |      |   |        |  |   |       
|-------- |  | ----------------------- | ------ | ---- | - | ------ |  | - | ------
|         |  | Year Ended December 31,
|         |  | 2004                    |        | 2005 |   | 2006  
|         |  | (in thousands)         
|Revenues |  |                         |        |      |   |        |  |   |       
|U.S.     |  | $                       | 21,262 |      | $ | 29,499 |  | $ | 41,229
|Europe   |  |                         | 4,269  |      |   | 6,711  |  |   | 9,756 
|Asia     |  |                         | 1,168  |      |   | 1,901  |  |   | 2,063 
|Other    |  |                         | 905    |      |   | 1,394  |  |   | 2,817 
|         |  |                         |        |      |   |        |  |   |       
|         |  | $                       | 27,604 |      | $ | 39,505 |  | $ | 55,865
|         |  |                         |        |      |   |        |  |   |       

At December 31, 2005 and 2006, the Companys property and equipment, net of accumulated
depreciation and amortization in the United States was approximately $2,720,000 and $5,710,000, respectively. At December 31, 2005 and 2006, the Companys property and equipment, net of accumulated depreciation and amortization in foreign
countries was approximately $119,000 and $816,000, respectively.



F-24



---

##### Table of Contents

Note 17.    Restatement of Financial Information

The Companys 2004 consolidated statements of operations, stockholders deficit, and cash flows were restated in previously issued financial
statements included in Form S-1 Registration Statement originally filed September 15, 2006.

Note 18.    Pro Forma Information
(Unaudited)

The pro forma unaudited income tax adjustments presented represent taxes which would have been reported had the Company
been subject to Federal and State income taxes as a C-Corporation. The pro forma provision for income taxes differs from the statutory income tax rate due to the following (in thousands):



|                                           |  |                                |      |   |      |   |      |      |  |   |        |  
|------------------------------------------ |  | ------------------------------ | ---- | - | ---- | - | ---- | ---- |  | - | ------ | -
|                                           |  | For the year endedDecember 31, |     
|                                           |  | 2004                           |      |   | 2005 |   |      | 2006 | 
|Federal income taxes at the statutory rate |  | $                              | (266 | ) |      | $ | 554  |      |  | $ | (1,030 | )
|State income taxes, net of federal benefit |  |                                | (148 | ) |      |   | 9    |      |  |   | (143   | )
|Extraterritorial income exclusion          |  |                                | (255 | ) |      |   | (103 | )    |  |   |       |  
|Research credits                           |  |                                | (158 | ) |      |   | (156 | )    |  |   | 329    |  
|Non-deductible compensation                |  |                                |     |   |      |   |     |      |  |   | (416   | )
|Change in valuation allowance              |  |                                | 744  |   |      |   | 27   |      |  |   | 1,120  |  
|Other                                      |  |                                | 93   |   |      |   | 12   |      |  |   | 179    |  
|                                           |  |                                |      |   |      |   |      |      |  |   |        |  
|                                           |  | $                              | 10   |   |      | $ | 343  |      |  | $ | 39     |  
|                                           |  |                                |      |   |      |   |      |      |  |   |        |  

The pro forma benefit for deferred income taxes reflects temporary differences in the recognition
of revenue and expenses for tax and financial reporting purposes as follows (in thousands):



|                                                     |  |                                |        |   |      |   |        |      |  |   |        |  
|---------------------------------------------------- |  | ------------------------------ | ------ | - | ---- | - | ------ | ---- |  | - | ------ | -
|                                                     |  | For the year endedDecember 31, |       
|                                                     |  | 2004                           |        |   | 2005 |   |        | 2006 | 
|Net operating losses                                 |  | $                              | 684    |   |      | $ |       |      |  | $ | 920    |  
|Tax credits                                          |  |                                | 677    |   |      |   | 580    |      |  |   | 997    |  
|Deferred revenue                                     |  |                                | 1,927  |   |      |   | 2,469  |      |  |   | 1,734  |  
|Accrued expenses                                     |  |                                | 304    |   |      |   | 634    |      |  |   | 1,156  |  
|Depreciable assets                                   |  |                                | (159   | ) |      |   | (223   | )    |  |   | (307   | )
|Other accruals and reserves                          |  |                                |       |   |      |   |       |      |  |   | 59     |  
|                                                     |  |                                |        |   |      |   |        |      |  |   |        |  
|Net deferred tax assets prior to valuation allowance |  |                                | 3,433  |   |      |   | 3,460  |      |  |   | 4,459  |  
|Valuation allowance                                  |  |                                | (3,433 | ) |      |   | (3,460 | )    |  |   | (4,459 | )
|                                                     |  |                                |        |   |      |   |        |      |  |   |        |  
|Net deferred tax assets                              |  | $                              |       |   |      | $ |       |      |  | $ |       |  
|                                                     |  |                                |        |   |      |   |        |      |  |   |        |  

Note 19.    Subsequent Events

On January 10, 2007, the Company entered into a fifth amendment to its revolving line of credit lowering the interest rate from the Prime Rate minus
..25% to Prime Rate minus .75% and removing the financial covenant limiting the Companys capital expenditures.

In February 2007, the
Company granted approximately 13,000 restricted shares to certain executives and employees.

On February 16, 2007, the Company
received a waiver from the bank for its debt covenant violations for the period ended December 31, 2006 (Note 6).



F-25



---

##### Table of Contents

Note 20.    Unaudited Quarterly Information

The following tables set forth below unaudited quarterly data. In the opinion of management, the following unaudited quarterly data has been prepared on
the same basis as the audited financial statements and includes all adjustments, consisting of normal recurring adjustments, necessary for a fair presentation of the results of operations for the periods presented.



|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|---------------------------------------------------------------- |  | ------------------------------------- | ------ | - | ------------ | - | ------ | ------------- |  | - | ----------- | - |  | ------------ | ------ | - | ------------ | - | ------ | ------------- |  | - | ----------- | - |  | ------------ | ------ | - | ------------ | - | ------ | ------------ |  | - | ----------- | - |  | - | ------ | - |  | - | ------ | - |  | - | ------ | -
|                                                                 |  | Quarter Ended                         |       
|                                                                 |  | Mar. 31,2004                          |        |   | June 30,2004 |   |        | Sept. 30,2004 |  |   | Dec. 312004 |   |  | Mar. 31,2005 |        |   | June 30,2005 |   |        | Sept. 30,2005 |  |   | Dec. 312005 |   |  | Mar. 31,2006 |        |   | June 30,2006 |   |        | Sept 30,2006 |  |   | Dec. 312006 |  
|                                                                 |  | (in thousands, except per share data) |       
|Revenue:                                                         |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Product revenue                                                  |  | $                                     | 2,649  |   |              | $ | 3,464  |               |  | $ | 4,312       |   |  | $            | 5,387  |   |              | $ | 4,121  |               |  | $ | 5,032       |   |  | $            | 6,290  |   |              | $ | 7,695  |              |  | $ | 6,203       |   |  | $ | 6,953  |   |  | $ | 9,207  |   |  | $ | 10,202 |  
|Services and maintenance revenue                                 |  |                                       | 2,388  |   |              |   | 3,081  |               |  |   | 3,235       |   |  |              | 3,088  |   |              |   | 3,721  |               |  |   | 3,951       |   |  |              | 4,039  |   |              |   | 4,656  |              |  |   | 4,968       |   |  |   | 5,920  |   |  |   | 5,588  |   |  |   | 6,824  |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Total revenues                                                   |  |                                       | 5,037  |   |              |   | 6,545  |               |  |   | 7,547       |   |  |              | 8,475  |   |              |   | 7,842  |               |  |   | 8,983       |   |  |              | 10,329 |   |              |   | 12,351 |              |  |   | 11,171      |   |  |   | 12,873 |   |  |   | 14,795 |   |  |   | 17,026 |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Cost of revenues                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Cost of product revenue                                          |  |                                       | 338    |   |              |   | 465    |               |  |   | 432         |   |  |              | 450    |   |              |   | 454    |               |  |   | 540         |   |  |              | 583    |   |              |   | 625    |              |  |   | 477         |   |  |   | 547    |   |  |   | 599    |   |  |   | 806    |  
|Cost of services and maintenance revenue                         |  |                                       | 1,727  |   |              |   | 2,128  |               |  |   | 2,080       |   |  |              | 1,995  |   |              |   | 1,871  |               |  |   | 2,081       |   |  |              | 2,287  |   |              |   | 2,907  |              |  |   | 2,608       |   |  |   | 3,139  |   |  |   | 3,462  |   |  |   | 4,430  |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Total cost of revenues                                           |  |                                       | 2,065  |   |              |   | 2,593  |               |  |   | 2,512       |   |  |              | 2,445  |   |              |   | 2,325  |               |  |   | 2,621       |   |  |              | 2,870  |   |              |   | 3,532  |              |  |   | 3,085       |   |  |   | 3,686  |   |  |   | 4,061  |   |  |   | 5,236  |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Gross profit                                                     |  |                                       | 2,972  |   |              |   | 3,952  |               |  |   | 5,035       |   |  |              | 6,030  |   |              |   | 5,517  |               |  |   | 6,362       |   |  |              | 7,459  |   |              |   | 8,819  |              |  |   | 8,086       |   |  |   | 9,187  |   |  |   | 10,734 |   |  |   | 11,790 |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Operating Expenses:                                              |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Selling and marketing                                            |  |                                       | 2,222  |   |              |   | 2,693  |               |  |   | 2,779       |   |  |              | 2,767  |   |              |   | 3,052  |               |  |   | 3,788       |   |  |              | 3,858  |   |              |   | 4,993  |              |  |   | 5,108       |   |  |   | 6,434  |   |  |   | 6,683  |   |  |   | 8,013  |  
|Research and development                                         |  |                                       | 689    |   |              |   | 801    |               |  |   | 915         |   |  |              | 890    |   |              |   | 867    |               |  |   | 858         |   |  |              | 1,484  |   |              |   | 1,471  |              |  |   | 1,452       |   |  |   | 1,734  |   |  |   | 2,062  |   |  |   | 1,865  |  
|General and administrative                                       |  |                                       | 852    |   |              |   | 1,019  |               |  |   | 1,088       |   |  |              | 935    |   |              |   | 966    |               |  |   | 1,298       |   |  |              | 1,040  |   |              |   | 1,629  |              |  |   | 1,711       |   |  |   | 1,762  |   |  |   | 2,062  |   |  |   | 2,305  |  
|Depreciation and amortization                                    |  |                                       | 236    |   |              |   | 277    |               |  |   | 285         |   |  |              | 360    |   |              |   | 317    |               |  |   | 332         |   |  |              | 328    |   |              |   | 370    |              |  |   | 360         |   |  |   | 432    |   |  |   | 489    |   |  |   | 542    |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Total operating expenses                                         |  |                                       | 3,999  |   |              |   | 4,790  |               |  |   | 5,067       |   |  |              | 4,952  |   |              |   | 5,202  |               |  |   | 6,276       |   |  |              | 6,710  |   |              |   | 8,463  |              |  |   | 8,631       |   |  |   | 10,362 |   |  |   | 11,296 |   |  |   | 12,725 |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Operating (loss) income                                          |  |                                       | (1,027 | ) |              |   | (838   | )             |  |   | (32         | ) |  |              | 1,078  |   |              |   | 315    |               |  |   | 86          |   |  |              | 749    |   |              |   | 356    |              |  |   | (545        | ) |  |   | (1,175 | ) |  |   | (562   | ) |  |   | (935   | )
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Other income and expense:                                        |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Interest income                                                  |  |                                       |       |   |              |   | 1      |               |  |   | 1           |   |  |              | 1      |   |              |   | 3      |               |  |   | 11          |   |  |              | 10     |   |              |   | 30     |              |  |   | 26          |   |  |   | 12     |   |  |   | 9      |   |  |   | 58     |  
|Interest expense                                                 |  |                                       | (19    | ) |              |   | (25    | )             |  |   | (22         | ) |  |              | (46    | ) |              |   | (21    | )             |  |   | (16         | ) |  |              | (21    | ) |              |   | (23    | )            |  |   | (9          | ) |  |   | (12    | ) |  |   | (27    | ) |  |   | (43    | )
|Other income, net                                                |  |                                       | 32     |   |              |   | 44     |               |  |   | 40          |   |  |              | 30     |   |              |   | 20     |               |  |   | 43          |   |  |              | 43     |   |              |   | 44     |              |  |   | 34          |   |  |   | 35     |   |  |   | 44     |   |  |   | 60     |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|(Loss) income before income taxes                                |  |                                       | (1,014 | ) |              |   | (818   | )             |  |   | (13         | ) |  |              | 1,063  |   |              |   | 317    |               |  |   | 124         |   |  |              | 781    |   |              |   | 407    |              |  |   | (494        | ) |  |   | (1,140 | ) |  |   | (536   | ) |  |   | (860   | )
|Income tax provision                                             |  |                                       | 1      |   |              |   | 7      |               |  |   |            |   |  |              | 2      |   |              |   | 11     |               |  |   |            |   |  |              | 2      |   |              |   |       |              |  |   | 16          |   |  |   | 6      |   |  |   |       |   |  |   | 17     |  
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Net (loss) income                                                |  | $                                     | (1,015 | ) |              | $ | (825   | )             |  | $ | (13         | ) |  | $            | 1,061  |   |              | $ | 306    |               |  | $ | 124         |   |  | $            | 779    |   |              | $ | 407    |              |  | $ | (510        | ) |  | $ | (1,146 | ) |  | $ | (536   | ) |  | $ | (877   | )
|                                                                 |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Net (loss) income per share:                                     |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Basic                                                            |  | $                                     | (0.05  | ) |              | $ | (0.04  | )             |  | $ | (0.00       | ) |  | $            | 0.05   |   |              | $ | 0.01   |               |  | $ | 0.01        |   |  | $            | 0.04   |   |              | $ | 0.02   |              |  | $ | (0.02       | ) |  | $ | (0.06  | ) |  | $ | (0.03  | ) |  | $ | (0.05  | )
|Diluted                                                          |  | $                                     | (0.05  | ) |              | $ | (0.04  | )             |  | $ | (0.00       | ) |  | $            | 0.05   |   |              | $ | 0.01   |               |  | $ | 0.01        |   |  | $            | 0.04   |   |              | $ | 0.02   |              |  | $ | (0.02       | ) |  | $ | (0.06  | ) |  | $ | (0.03  | ) |  | $ | (0.05  | )
|Weighted Average number of shares used in per share calculation: |  |                                       |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |               |  |   |             |   |  |              |        |   |              |   |        |              |  |   |             |   |  |   |        |   |  |   |        |   |  |   |        |  
|Basic                                                            |  |                                       | 18,612 |   |              |   | 18,612 |               |  |   | 19,843      |   |  |              | 20,412 |   |              |   | 20,412 |               |  |   | 20,412      |   |  |              | 20,412 |   |              |   | 20,412 |              |  |   | 20,417      |   |  |   | 19,903 |   |  |   | 18,789 |   |  |   | 19,487 |  
|Diluted                                                          |  |                                       | 18,612 |   |              |   | 18,612 |               |  |   | 19,843      |   |  |              | 20,678 |   |              |   | 20,757 |               |  |   | 20,981      |   |  |              | 21,363 |   |              |   | 21,409 |              |  |   | 20,417      |   |  |   | 19,903 |   |  |   | 18,789 |   |  |   | 19,487 |  



F-26



---

##### Table of Contents

SIGNATURE

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934,
the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

March 29, 2007



Guidance Software, Inc.By

/s/    JOHN COLBERTJohn Colbert Chief Executive Officer (Principal Executive Officer)


Pursuant to the requirements of the Securities Exchange Act of 1934, this Report has been
signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated:



|                                         |  |                                                                      |  |               
|---------------------------------------- |  | -------------------------------------------------------------------- |  | --------------
|Signature                                |  | Title                                                                |  | Date          
|                                         |  |                                                                     
|/s/    JOHN
COLBERT John Colbert         |  | Chief Executive Officer and Director (Principal Executive Officer)   |  | March 29, 2007
|                                         |  |                                                                     
|/s/    FRANK J.
SANSONE Frank J. Sansone |  | Chief Financial Officer (Principal Financial and Accounting Officer) |  | March 29, 2007
|                                         |  |                                                                     
|/s/    SHAWN
MCCREIGHT Shawn McCreight   |  | Chairman and Chief Technology Officer                                |  | March 29, 2007
|                                         |  |                                                                     
|/s/    JOHN
PATZAKIS John Patzakis       |  | Vice Chairman and Chief Legal Officer                                |  | March 29, 2007
|                                         |  |                                                                     
|/s/    KATHLEEN
ONEIL Kathleen ONeil   |  | Director                                                             |  | March 29, 2007
|                                         |  |                                                                     
|/s/    GEORGE
TENET George Tenet         |  | Director                                                             |  | March 29, 2007
|                                         |  |                                                                     
|/s/    AMIT
YORAN Amit Yoran             |  | Director                                                             |  | March 29, 2007
|                                         |  |                                                                     
|/s/    LYNN
TURNER Lynn Turner           |  | Director                                                             |  | March 29, 2007



S-1



---

##### Table of Contents

SCHEDULE II

GUIDANCE SOFTWARE, INC.

VALUATION AND QUALIFYING ACCOUNTS



|                                |  |                              |         |                                      |   |                                |  |   |                        |   |  |   |        
|------------------------------- |  | ---------------------------- | ------- | ------------------------------------ | - | ------------------------------ |  | - | ---------------------- | - |  | - | -------
|Description                     |  | Balance atBeginningof Period |         | AdditionsCharged toCosts andExpenses |   | Deductionsand OtherAdjustments |  |   | Balance atEnd ofPeriod
|Year ended December 31, 2004:   |  |                              |         |                                      |   |                                |  |   |                        |   |  |   |        
|Allowance for doubtful accounts |  | $                            | 101,000 |                                      | $ | 192,000                        |  | $ | (159,000               | ) |  | $ | 134,000
|Year ended December 31, 2005:   |  |                              |         |                                      |   |                                |  |   |                        |   |  |   |        
|Allowance for doubtful accounts |  | $                            | 134,000 |                                      | $ | 97,000                         |  | $ | (92,000                | ) |  | $ | 139,000
|Year ended December 31, 2006:   |  |                              |         |                                      |   |                                |  |   |                        |   |  |   |        
|Allowance for doubtful accounts |  | $                            | 139,000 |                                      | $ | 514,000                        |  | $ | (211,000               | ) |  | $ | 442,000



II-1