Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

x      QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE QUARTERLY PERIOD ENDED MARCH 31, 2012

OR

o         TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from                      to                     

Commission File Number 001-33197

GUIDANCE SOFTWARE, INC.

(Exact name of registrant as specified in its charter)

Securities registered pursuant to Section 12(b) of the Act:

Common Stock, $0.001 par value per share.

Securities registered pursuant to Section 12(g) of the Act:

None.

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes x  No o

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).  Yes x  No o

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).  Yes o  No x

As of May 14, 2012, there were approximately 24,855,000 shares of the registrant’s Common Stock outstanding.

Table of Contents

GUIDANCE SOFTWARE, INC.

FORM 10-Q

FOR THE QUARTERLY PERIOD ENDED MARCH 31, 2012

Table of Contents

Table of Contents

PART I. FINANCIAL INFORMATION

Item  1.                                 Financial Statements

GUIDANCE SOFTWARE, INC.

CONDENSED CONSOLIDATED BALANCE SHEETS

(in thousands, except share and per share data)

(Unaudited)

The accompanying notes are an integral part of these consolidated financial statements

1

Table of Contents

GUIDANCE SOFTWARE, INC.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(in thousands, except per share data)

(Unaudited)

The accompanying notes are an integral part of these consolidated financial statements

2

Table of Contents

GUIDANCE SOFTWARE, INC.

CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

(in thousands)

(Unaudited)

The accompanying notes are an integral part of these consolidated financial statements

3

Table of Contents

GUIDANCE SOFTWARE, INC.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS

(Unaudited)

Note 1. Description of the Business

General

Guidance Software, Inc. was incorporated in the state of California in 1997 and reincorporated in Delaware on December 11, 2006. Guidance and its subsidiaries are collectively referred to herein as “Guidance,” “we” or the “Company.” Headquartered in Pasadena, California, Guidance is the leading global provider of digital investigative solutions.  Our EnCase® platform provides an investigative infrastructure that enables our customers to search, collect and analyze electronically stored information in order to address human resources matters, litigation matters, allegations of fraud, suspicious network endpoint activity and defend their organization’s data assets.

Our main products and services are:

EnCase®Enterprise, a comprehensive, network-enabled digital investigative solution that enables corporations and government agencies to search, collect, preserve and analyze data across all of the servers, desktops and laptops that comprise their entire network from a single location.  It also serves as a platform on which more powerful electronic discovery and cybersecurity products, described below, are built;

EnCase® eDiscovery, which automates the search, collection preservation and processing of electronically stored information for litigation and compliance purposes;

EnCase® Cybersecurity, which provides the ability to identify and analyze undiscovered threats, such as polymorphic or metamorphic malware, and other advanced hacking techniques that evade traditional network or host-based defenses and includes investigative capabilities that target confidential or sensitive data and risk mitigation by wiping sensitive data from unauthorized locations;

EnCase® Forensic, a desktop-based product primarily used by law enforcement, government agencies, and consultancies, for collecting, preserving, analyzing and authenticating electronic computer forensic data for use in criminal and civil court proceedings;

Tableau ™, a family of data acquisition forensic hardware products, including forensic duplicators, multiple write blockers and other hardware; and

CaseCentral®, cloud-based document review and production software-as-a-service for corporations and law firms.

In addition, we complement these offerings with a comprehensive array of professional and training services including technical support and maintenance services to help our customers implement our solutions, conduct investigations and train their IT and legal professionals to effectively and efficiently use our products.

Note 2. Summary of Significant Accounting Policies

Basis of Presentation

The accompanying condensed consolidated balance sheet as of March 31, 2012 and the condensed consolidated statements of operations and cash flows for the three months ended March 31, 2012 and 2011 are unaudited. These statements should be read in conjunction with the audited consolidated financial statements and related notes, together with management’s discussion and analysis of financial position and results of operations, contained in our Annual Report on Form 10-K for the year ended December 31, 2011, filed with the U.S. Securities and Exchange Commission (the “SEC”) on February 16, 2012. The operating results for the three-month period ended March 31, 2012 and cash flows for the three-month period ended March 31, 2012 are not necessarily indicative of the results that will be achieved for the full fiscal year or for future periods.

The accompanying condensed consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States, or (“GAAP”), and pursuant to the rules and regulations of the SEC for interim financial reporting. In the opinion of our management, the unaudited condensed consolidated financial statements have been prepared on the same basis as the audited consolidated financial statements in the Annual Report on Form 10-K for the year ended December 31, 2011 and include all adjustments necessary for the fair presentation of our financial position as of March 31, 2012 and our results of operations and cash flows for the three months ended March 31, 2012 and 2011. The condensed consolidated balance sheet as of December 31, 2011 has been derived from the December 31, 2011 audited financial statements. The interim financial information contained in this Quarterly Report is not necessarily indicative of the results to be expected for any other interim period or for the entire year.

4

Table of Contents

The condensed consolidated financial statements include the accounts of Guidance and its wholly owned subsidiaries. All significant intercompany accounts and transactions have been eliminated.

Use of Estimates and Assumptions

The preparation of financial statements in conformity with GAAP requires management to make estimates and judgments that affect the reported amounts of assets, liabilities, revenues and expenses, and related disclosure of contingent assets and liabilities. On an ongoing basis, we evaluate these estimates, including those related to revenue recognition, share-based compensation, bad debts, income taxes, commitments, contingencies and litigation. We base our estimates on historical experience and on various other assumptions that are believed to be reasonable under the circumstances. Actual results may differ from these estimates.

Cash and Cash Equivalents

We invest cash in excess of our daily operating needs in money market funds and highly liquid debt instruments of the US government and its agencies. Highly liquid investments with stated maturities of three months or less from date of purchase are classified as cash and cash equivalents.

Fair Value of Financial Instruments

The carrying amounts of cash equivalents, accounts receivable and accounts payable approximate fair value because of the short-term maturities of these instruments. Based on borrowing rates currently available to us for borrowings with similar terms, the carrying values of our capital lease obligations also approximate fair value.

Trade Receivables

Trade receivables are carried at original invoice amount less an allowance for doubtful accounts. The allowance is established through a provision for bad debt expense, which is included in general and administrative expense. We determine the adequacy of this allowance by evaluating individual customer accounts receivable, through consideration of the customer’s financial condition, credit history and current economic conditions. In addition, we analyze our historical credit loss history and apply these loss rates to our current accounts receivable balances to verify the reasonableness of our allowance. Trade receivables are written off when deemed uncollectible. A trade receivable is generally considered past due if any portion of the receivable balance is outstanding for more than 30 days unless alternate terms are provided.

Inventory

Inventory is comprised of hardware components, packaged software components and finished goods and is valued at the lower of cost or market, using the weighted average cost method. We conduct quarterly inventory reviews for obsolescence, and inventory considered unlikely to be sold is adjusted to net realizable value.

Business Combinations

The purchase price of an acquisition is allocated to the underlying assets acquired and liabilities assumed based upon their estimated fair values at the date of acquisition. To the extent the purchase price exceeds the fair value of the net identifiable tangible and intangible assets acquired and liabilities assumed, such excess is allocated to goodwill. We determine the estimated fair values after review and consideration of relevant information including discounted cash flows, quoted market prices and estimates made by management. Accordingly, these can be affected by certain performance measurements and other factors over time, which may cause final amounts to differ materially from original estimates. We adjust the preliminary purchase price allocation, as necessary, up to periods of one year after the acquisition closing date as we obtain more information regarding asset valuations and liabilities assumed.  We refer to this preliminary purchase price allocation period as the measurement period.

Goodwill acquired in business combinations is assigned to the reporting unit(s) expected to benefit from the combination as of the acquisition date.  Acquisition related costs are recognized separately from the acquisition and are expensed as incurred.

5

Table of Contents

Amortization of Intangible Assets with Finite Lives

Intangible assets with finite lives are carried at the implied fair value of such assets at the time of acquisition.  With the exception of our customer relationships intangible asset, which is amortized on a double-declining basis, the implied fair values of such assets are amortized on a straight-line basis over the estimated useful lives.

Goodwill and Indefinite-Lived Intangibles

Goodwill represents the excess of purchase price over fair value of net assets acquired and is assigned to a reporting unit at the date the goodwill is initially recorded. Goodwill and indefinite-lived intangible assets are not amortized but evaluated for impairment annually, or whenever events or changes in circumstances indicate that the value may not be recoverable. For the annual goodwill impairment test, the Company has the option to first perform a qualitative assessment to determine whether it is more likely than not that the fair value of a reporting unit is less than its carrying amount. If this is not the case, goodwill is not impaired and no further steps are required.  If the Company elects not to first perform the qualitative assessment option, or it performs such assessment and determines that the fair value of a reporting unit is less than its carrying amount, it is required to perform a two-step test at the reporting unit level to assess goodwill for impairment. First, the fair value of the reporting unit is compared to its carrying value. If the fair value exceeds the carrying value, the reporting unit is not impaired and no further testing is performed. The second step is performed if the carrying value exceeds the fair value. If the carrying value of the reporting unit exceeds its implied fair value, an impairment loss equal to the difference will be recorded. Indefinite-lived intangible assets are assessed for impairment by comparing the carrying value of the assets with their fair values. If the carrying value of an indefinite-lived intangible asset exceeds its implied fair value, an impairment loss equal to the difference will be recorded.

Application of the impairment test requires significant judgment to estimate the fair value. Changes in estimates and assumptions could materially affect the determination of fair value and/or impairment.

Concentrations of Credit Risk

Financial instruments that potentially subject us to significant concentrations of credit risk consist primarily of cash and cash equivalents and accounts receivable. We restrict our investments in cash and cash equivalents to financial institutions, US government or federal agency instruments and obligations of corporations with high credit ratings. At March 31, 2012, the majority of our cash balances were held at financial institutions located in California in accounts that are insured by the Federal Deposit Insurance Corporation for up to $250,000. Uninsured balances aggregate approximately $25.2 million as of March 31, 2012.  At March 31, 2012, all of our cash equivalents consisted of financial institution obligations. We periodically perform credit evaluations of our customers and maintain reserves for potential losses on our accounts receivable. We do not believe we are subject to concentrations of credit risk with respect to such receivables.

Revenue Recognition

We generate revenues principally from the sale of EnCase®Enterprise and EnCase® Forensic software products.  Revenue associated with the sale of software licenses and revenue associated with forensic hardware sales are referred to as product revenue.  With the acquisition of CaseCentral in February of 2012, we now have revenue associated with cloud-based document review and production software-as-a-service which is referred to as subscription revenue.  Revenues are also generated from training courses, implementation services and consulting services in which we assist customers with the performance of digital investigations and train their IT professionals in the use of our software products, which we collectively refer to as services revenue.  Our proprietary products are generally sold with one to three years of maintenance, which can be renewed at a stated renewal rate and is referred to as maintenance revenue.

We recognize revenue in accordance with Accounting Standards Update (“ASU”) 2009-13, Multiple-Deliverable Revenue Arrangements, (amendment to Accounting Standards Codification (“ASC”) Topic 605, Revenue Recognition),  Software Industry-Revenue Recognition topic (ASC 985-605) and Revenue Recognition (ASC 605).  While the standards govern the basis for revenue recognition, significant judgment and the use of estimates are required in connection with the allocation of revenue between product, subscription, services and maintenance revenues, as well as the amount of deferred revenue to be recognized in each accounting period.

When arrangements involve multiple elements that qualify as separate units of accounting, the consideration is allocated at inception of the arrangement to all deliverables based on the relative selling price method in accordance with the selling price hierarchy, which includes:  1) vendor-specific objective evidence of fair value (“VSOE”), if available, 2) third-party evidence (“TPE”) if VSOE is not available, or 3) best estimate of selling price (“BESP”) if neither VSOE nor TPE is available.

6

Table of Contents

·                  VSOE.  VSOE is determined based on its historical pricing and discounting practices for the specific product or service when sold separately.  In determining VSOE, we require that a substantial majority of the selling prices for these services fall within a reasonably narrow pricing range.

·                  TPE.  When VSOE cannot be established for deliverables in a multiple element arrangement, judgment is applied with respect to whether we can establish a selling price based on TPE.  TPE is determined based on competitor prices for similar deliverables when sold separately.  Generally, our go-to-market strategy differs from our peers and our offerings contain a significant level of differentiation such that comparable pricing of services with similar functionality has not been obtained.  Furthermore, we have been unable to reliably determine selling prices of similar competitive services on a stand-alone basis.  As a result, we have not been able to establish selling prices based on TPE.

·                  BESP.  When VSOE or TPE is unable to be established, we use BESP in our allocation of arrangement consideration.  The objective of BESP is to determine the price at which we would transact a sale if the service was sold on a stand-alone basis.  We determine BESP for deliverables by considering multiple factors including but not limited to prices we charge for similar offerings, market conditions, competitive landscape and pricing practices.

We have established VSOE for our proprietary products and services, but have not established VSOE or TPE for our subscription services or usage-based fee arrangements and therefore we use BESP to allocate the selling price to subscription services and usage-based fee deliverables.

Product revenue.  The timing of product revenue recognition is dependent on the nature of the product sold. We do not have any product offerings where software components and non-software components function together to deliver the tangible product’s essential functionality. Product arrangements comprising multiple deliverables including software and hardware are generally categorized into one of the following:

·                          EnCase® Enterprise Solutions and EnCase® Forensic Solutions: Revenue associated with these arrangements, exclusive of amounts allocated to maintenance and other undelivered elements, for which we have vendor-specific objective evidence (“VSOE”) of fair value, is recognized upon delivery, provided that all other criteria for revenue recognition have been met.

·                          Hardware: Revenue associated with the sale of forensic hardware is recognized upon shipment to the customers which include certain resellers, provided that all other criteria for revenue recognition have been met.

Subscription revenue.  Customers pay subscription fees to access our cloud-based document review and production software; however, they may not take possession of the software at any time during the term of the agreement.  In general, we recognize revenue for subscription fees on a straight-line basis over the contract period commencing on the date the subscription is made available to the customer.  Usage-based fees, that are determined monthly, are recognized when incurred.

Services and Maintenance Revenue. The majority of our consulting and implementation services are performed under per hour, or fixed fee arrangements. Revenue from such services is recognized as the services are provided or upon expiration of the contractual service period.

Training revenues are either recognized on a per-class basis upon a participant’s attendance or, for those customers who have subscribed to our Annual Training Passport program, revenue is recognized ratably over the annual period.

Revenue related to technical support and software updates on a when-and-if available basis is referred to as maintenance revenue. We recognize maintenance revenue ratably over the applicable maintenance period. We determine the amount of maintenance revenue to be deferred through reference to substantive maintenance renewal provisions contained in multiple element arrangements. We consider substantive maintenance provisions to be provisions where the cost of the maintenance renewal, stated in the contract with our customer as a percentage of the product fee, is comparable to the normal pricing for maintenance only renewals.

Revenue Recognition Criteria. Our basic revenue recognition criteria are as follows:

·                          Persuasive evidence of an arrangement: If we either enter into contracts or receive written purchase orders issued by a customer that legally bind us and the customer, we consider that as evidence of an arrangement.

·                          Product delivery: We deem delivery of a product to have occurred when the title and risk of ownership have passed to the buyer. Services revenue is recognized as delivered.

7

Table of Contents

·                          Fixed or determinable fee: We consider the fee to be fixed or determinable if the fee is not subject to refund or adjustment and the payment terms are within normal established practices. If the fee is not fixed or determinable, we recognize revenue as amounts become due and payable provided all other revenue recognition criteria have been met.

·                          Collection is deemed probable: We conduct a credit review for all significant transactions at the time of the arrangement to determine the credit-worthiness of the customer. Collection is deemed probable if we have a reasonable basis to expect that a customer will pay amounts due under an arrangement as they become due.

Recent Accounting Pronouncements

Accounting standards updates effective after March 31, 2012 are not expected to have a material effect on the Company’s consolidated financial position or results of operations.

Note 3. Business Combination

On February 21, 2012, we acquired CaseCentral Inc. (“CaseCentral”), a privately held cloud-based document review and production software-as-a-service (“SAAS”) provider for an aggregate purchase price of approximately $25.5 million, consisting of $9.5 million in cash (net of $1.4 million in cash acquired), $9.5 million of our common stock, consisting of 849,554 shares valued at the market price of $11.18 per share on the closing date of the transaction, and contingent consideration which had a fair value of $5.1 million as of the closing date of the transaction. Depending on CaseCentral’s SaaS revenue over the next three years, we may be required to pay up to a maximum of $33.0 million in cash to CaseCentral’s former shareholders over the next three 12-month periods starting April 1, 2012.  The estimated fair value of the contingent consideration is determined as described in Note 12.  We incurred $2.0 million in acquisition-related costs in the quarter ended March 31, 2012 which were expensed as incurred and included in general and administrative expenses.

We acquired CaseCentral to extend our market leadership by delivering a complete and integrated platform solving the e-discovery needs of corporate and government customers. The CaseCentral acquisition closed on February 21, 2012 and the results of operations of CaseCentral have been included in the Company’s condensed consolidated financial statements subsequent to such date.  CaseCentral’s revenues, expenses and net income included in the Condensed Consolidated Statements of Operations from the acquisition date through March 31, 2012 were approximately $2.0 million in revenue and $2.0 million in expenses resulting in no net income.

The assets and liabilities of CaseCentral have been recorded at their estimated fair values at the date of acquisition. The excess of the purchase price over the estimated fair values of the underlying net tangible and identifiable intangible assets has been recorded as goodwill. The fair value of net tangible assets other than deferred revenue approximate their carrying values on the date of acquisition.  The fair value assigned to deferred revenue was determined based on estimated costs to fulfill the underlying service obligation. The fair value assigned to identifiable intangible assets was determined primarily by using a discounted cash flow method.  The acquisition transaction was a stock purchase in which the income tax attributes of CaseCentral carried over to the Company.  The estimated deferred income tax attributes of CaseCentral, after establishment of deferred income tax liabilities associated with the step-up of the fair values of the net assets acquired over their pre-acquisition tax basis, resulted in a net deferred income tax asset.  Given CaseCentral’s history of reporting net losses, our management concluded that realization of the net deferred income tax asset acquired is not likely and therefore a valuation allowance was established to offset the entire net deferred income tax asset.  As a result, deferred income taxes are not reflected in the table below.  The goodwill recognized for CaseCentral is attributable to intangible assets acquired that do not qualify for separate recognition, expected synergies that are projected to increase revenue and profits and an assembled workforce. The CaseCentral goodwill is assigned to our subscription reporting segment and is not tax deductible.

8

Table of Contents

The Company’s allocation of the purchase price is preliminary as the amounts related to contingent consideration, identifiable intangible assets, deferred revenue, and the effects of income taxes resulting from the transaction, are still being finalized. Any material measurement period adjustments will be recorded retroactively to the acquisition date.  The purchase price allocation, subject to finalization during the measurement period, is as follows (in thousands):

9

Table of Contents

The following are the unaudited pro forma condensed consolidated financial statements of the combined entity for the three-months ended March 31, 2012 and 2011 as though the business combination had been as of the beginning of the comparable prior reporting period (in thousands, except per share amounts).

Note 4. Net Income (Loss) Per Share

Basic net income (loss) per common share is calculated by dividing net income (loss) by the weighted average number of common shares outstanding during the reporting period. Diluted net income (loss) per share is calculated based on the weighted average number of common shares and dilutive potential common shares outstanding during the period. Dilutive potential common shares consist of the shares issuable upon the exercise of stock options and upon the vesting of restricted stock awards under the treasury stock method. In net loss periods, basic net loss per share and diluted net loss per share are identical since the effect of potential common shares is anti-dilutive and therefore excluded.

The following table sets forth the computation of basic and diluted net income (loss) per share (in thousands, except per share amounts):

Antidilutive securities, which consist of stock options and restricted stock awards that are not included in the diluted net loss per share calculation, consisted of an aggregate of approximately 1,829,000 and 2,227,000 shares as of March 31, 2012 and 2011, respectively.

Note 5. Inventory

Inventory is comprised of hardware components, packaged software components and finished goods and is valued at the lower of cost or market, using the weighted average cost method. The following table sets forth, by major classes, inventory as of March 31, 2012 and December 31, 2011 (in thousands):

10

Table of Contents

Note 6. Goodwill and Other Intangibles

We assess goodwill and indefinite-lived intangible assets for impairment annually as of April 30, or more frequently if circumstances indicate impairment may have occurred. Since the initial recording of the goodwill and indefinite-lived intangible assets balances reflected in the tables below, there has been no impairment charges related to such assets through March 31, 2012.  We expect the balance of goodwill assigned to our products segment to be deductible for tax purposes while the balance of goodwill assigned to our subscription segment will not be deductible for tax purposes.  The following table summarizes how goodwill is assigned to our reporting segments (in thousands):

In-process research and development intangible assets acquired are considered to be indefinite-lived until completion or abandonment of the associated research and development efforts. The Company will determine the estimated useful lives and amortization method of the asset upon completion of the research and development efforts. During the period the assets are considered indefinite-lived, impairment will be assessed annually or whenever events or changes in circumstances indicate that their carrying value may not be recoverable.

The following table summarizes goodwill and indefinite-lived intangible assets (in thousands):

In February 2012, the Company acquired CaseCentral resulting in acquired intangible assets. With the exception of customer relationships, which are amortized on a double-declining basis, the acquired intangible assets are being amortized over their estimated useful lives as noted in Note 3 above.

Amortization expense for intangible assets with finite lives was $0.5 million and $0.3 million for the three months ended March 31, 2012 and 2011, respectively.  The following table summarizes cumulative amortization expense related to intangible assets subject to amortization (in thousands):

11

Table of Contents

The following table summarizes the estimated remaining amortization expense through 2016 and thereafter (in thousands):

Note 7. Share Repurchase Program

In August 2008, our Board of Directors authorized a program to repurchase shares of our common stock having an aggregate value of up to $8.0 million. As of March 31, 2012, we had approximately $3.6 million remaining under this authorization. The authorization allows us to repurchase our common stock from time to time through open market purchases and negotiated transactions, or otherwise. The timing, nature and amount of such transactions will depend on a variety of factors, including market conditions, and the program may be suspended, discontinued or accelerated at any time. The sources of funds for the purchases under the remaining authorization are our existing cash on hand and cash from operations. Purchases are made in the open market, through block trades and other negotiated transactions. Repurchased shares are held in Treasury Stock and have not been retired.

In addition to the repurchased shares, the Company withheld approximately 69,000 common shares for the three months ended March 31, 2012 from employees to satisfy their personal income tax withholding requirements upon the vesting of restricted stock awards issued under our equity compensation plans. The Company may engage in similar transactions from time to time related to future vesting of employee restricted stock awards. See Part II. Item 2 of this Quarterly Report for further information regarding the share repurchase program.

Note 8. Debt Obligations

We maintain a $3.0 million revolving line of credit with a bank. Borrowings under this line of credit would be collateralized by substantially all our assets. The line of credit requires that we remain in compliance with certain financial covenants and in March 2011, an amendment to the credit agreement was entered into to extend the expiration date to May 31, 2012 and decrease the maximum cumulative net loss permitted under the credit facility to $5.0 million (excluding non-cash share-based compensation) during any one fiscal year. We are currently in negotiations with our bank to extend the expiration date of the line of credit. Borrowings under the amended credit agreement bear interest at one of the following rates (as selected by us): a rate equal to the bank’s alternate base rate plus 2% or the bank’s LIBOR plus 3%. As of March 31, 2012, there were no amounts outstanding under this line of credit and we were in compliance with the covenants associated with the revolving line of credit.

As of March 31, 2012, we had an outstanding stand-by letter of credit in the amount of $112,500, related to one of our facility leases and another outstanding stand-by letter of credit in the amount of $150,000, related to equipment leases, both secured by the revolving line of credit. There were no amounts outstanding under this line of credit at March 31, 2012 or December 31, 2011.

Note 9. Equity Incentive Plan

At our 2012 Annual Meeting of Stockholders, our stockholders approved the Second Amendment to the Guidance Software, Inc. Second Amended and Restated 2004 Equity Incentive Plan (the “Plan”).  The Second Amendment amended the Plan to:  increase the aggregate number of shares of our common stock available for awards under the Plan by an additional 2,500,000 shares from 9,088,313 shares to a total of 11,588,313 shares;  prohibits the re-pricing of stock options and the cancellation of underwater options in exchange for cash payments or other awards, without the approval of our stockholders; provides that shares tendered or withheld to satisfy the grant or exercise price or tax withholding obligation pursuant to any award will count against the limit of shares available for awards under the Plan; and to modify the initial and annual equity award grants to our non-employee directors.  Our Board of Directors approved the Second Amendment in March 2012, subject to approval by our stockholders at our 2012 Annual Meeting of Stockholders.  At March 31, 2012, approximately 219,000 shares were available for grant as options or nonvested share awards under the Plan.

The Guidance Software, Inc. First Amended and Restated 2004 Equity Incentive Plan originally became effective on November 10, 2006 and was amended on March 17, 2008 and February 13, 2009 to provide for certain annual equity award grants to non-employee members of the Company’s Board of Directors.  At the Company’s 2008 Annual Meeting of Stockholders the stockholders approved an amendment to the First Amended and Restated Plan that accelerated to July 1, 2008 the automatic increase in the number of shares available under the plan that was scheduled to occur on January 1, 2009.  On April 22, 2010, the stockholders approved the Plan which amended and restated the First Amended and Restated 2004 Equity Incentive Plan.  The Plan was amended on April 22, 2010 by the First Amendment thereto to modify the vesting schedule of the grants of annual restricted stock to non-employee directors.

12

Table of Contents

Stock Options

The terms of the options granted under the Plan are determined at the time of grant, and generally vest 25% annually over a four-year service period and typically must be exercised within 10 years from the date of grant.

A summary of stock option activity follows:

We define in-the-money options at March 31, 2012 as options that had exercise prices that were lower than the $11.05 fair market value of our common stock at that date. The aggregate intrinsic value of options outstanding at March 31, 2012 is calculated as the difference between the exercise price of the underlying options and the fair market value of our common stock for the 1,946,000 shares that were in-the-money at that date, of which 1,672,000 were exercisable.

Restricted Stock Awards

During 2007, we began issuing restricted stock awards to certain directors, officers and employees under the Plan. Compensation expense for such awards, based on the fair market value of the awards on the grant date, is recorded during the vesting period. Restricted stock awards generally vest 25% annually over a four-year service period.

A summary of restricted stock awards activity follows:

The total grant date fair value of shares vested under such grants during the three months ended March 31, 2012 was $1,203,000.

Note 10.  Share-Based Compensation

We account for share-based compensation in accordance with Compensation-Stock Compensation (ASC 718). Share-based compensation expense for all share-based awards is recognized using the Black-Scholes option pricing model to determine the grant date fair value of share-based payments. We recognize the cost, net of an estimated forfeiture rate, as compensation expense on a straight-line basis over the vesting period.

The fair values of awards granted under the Second Amended and Restated Plan were estimated at the date of grant and the following weighted average assumptions (no grants have been issued since January 2011):

13

Table of Contents

The volatility of our common stock is estimated at the date of grant based on a weighted-average of the implied volatility of publicly traded 30-day to 270-day options on the common stock of a select peer group of similar companies (“Similar Companies”), the historical volatility of the common stock of Similar Companies and, beginning in late 2007, the historical volatility of our common stock. The risk-free interest rate is based on the implied yield in effect at the time of each option grant, based on U.S. Treasury zero-coupon issues with equivalent remaining terms. We use an expected dividend yield of zero as we have no intention of paying any cash dividends on our common stock in the foreseeable future. Compensation-Stock Compensation requires us to estimate forfeitures at the time of grant and revise those estimates in subsequent periods if actual forfeitures differ from those estimates. We use historical data to estimate pre-vesting option forfeitures and record share-based compensation expense only for those awards that are expected to vest. We amortize share-based compensation on a straight-line basis over the requisite service period of the awards, which is generally the vesting period.  The expected term (life) of all stock option awards has been calculated using the weighted average expected life of each tranche of stock options, determined based on the sum of each tranche’s vesting period plus one-half of the period from the vesting date of each tranche to the stock option’s expiration because, due to the limited time our common stock has been publicly traded, we lack sufficient historical data to provide a reasonable basis to estimate the expected term of these options.

The following table summarizes the share-based compensation expense we recorded (in thousands):

As of March 31, 2012, there was approximately $0.8 million of total unrecognized share-based compensation cost related to stock options that is expected to be recognized over a weighted-average period of 1.8 years and approximately $19.8 million of total unrecognized share-based compensation cost related to restricted stock awards that is expected to be recognized over a weighted-average period of 3.3 years. We expect to record approximately $4.2 million in share-based compensation for the remainder of fiscal year 2012 related to stock options and restricted stock awards outstanding at March 31, 2012.

Note 11. Income Taxes

We account for income taxes in accordance with Income Taxes (ASC 740). Deferred income taxes are recorded for the expected tax consequences of temporary differences between the tax bases of assets and liabilities for financial reporting purposes and amounts recognized for income tax purposes. We record a valuation allowance to reduce our deferred tax assets to the amount of future tax benefit that is more likely than not to be realized. As of March 31, 2012, we have recorded a valuation allowance against our net deferred tax assets resulting in a carrying value of zero.

Management’s judgment is required in assessing the realizability of future deferred tax assets. We consider all available evidence, both positive and negative, including historical levels of income, expectations and risks associated with estimates of future taxable income and ongoing prudent and feasible tax planning strategies in assessing the need for a valuation allowance. If we later determine that it is more likely than not that the net deferred tax assets would be realized, we would reverse the applicable portion of the previously provided valuation allowance. Likewise, in the event we were to determine that we would not be able to realize all or part of our net deferred tax assets in the future, an adjustment to the deferred tax assets would be charged to earnings in the period in which we make such a determination. We have assumed the historical tax basis of all assets and liabilities, including net deferred tax assets and valuation allowance in our acquisition of CaseCentral.  Deferred taxes have been considered for the difference between fair market value measurement and historical tax basis of the underlying assets and liabilities.   We have adjusted our acquired deferred tax assets and valuation allowance by deferred tax liabilities identified in purchase accounting.  We do not expect any changes to our existing valuation allowance as a result of the business combination.

We file income tax returns with the Internal Revenue Service and the taxing authorities of various state and foreign jurisdictions. We periodically perform a review of our uncertain tax positions. An uncertain tax position represents our expected treatment of a tax position taken in a filed tax return, or planned to be taken in a future tax return, that has not been reflected in measuring income tax expense for financial reporting purposes. During the year ended December 31, 2011, our liability for uncertain tax positions was $0.4 million and the balance was unchanged at March 31, 2012. We do not expect there to be any material changes to the estimated amount of liability associated with our uncertain tax positions over the next twelve months. The tax years 2008 through 2010 remain subject to review by the taxing authorities in several jurisdictions. Most foreign jurisdictions have statute of limitations that range from three to six years.

14

Table of Contents

Note 12. Fair Value Measurements

We adopted Fair Value Measurements and Disclosures (ASC 820) effective January 1, 2008 for financial assets and liabilities measured at fair value on a recurring basis. There was no impact upon the adoption to the consolidated financial statements. Fair Value Measurements and Disclosures requires disclosure that establishes a framework for measuring fair value and expands disclosure about fair value measurements. Under this standard, fair value is defined as the price that would be received in exchange for selling an asset or paid to transfer a liability (i.e., the “exit price”) in an orderly transaction between market participants at the measurement date. Fair Value Measurements and Disclosures establishes a hierarchy for inputs used in measuring fair value that minimizes the use of unobservable inputs by requiring the use of observable market data when available. Observable inputs are inputs that market participants would use in pricing the asset or liability based on active market data. Unobservable inputs would be inputs that reflect our assumptions about the assumptions market participants would use in pricing the asset or liability based on the best information available in the circumstances. The statement requires fair value measurements be classified and disclosed in one of the following three categories:

The following table sets forth, by level within the fair value hierarchy, financial assets and liabilities that are accounted for at fair value on a recurring basis as of March 31, 2012 and December 31, 2011 (in thousands):

The Company has obligations, to be paid in cash, to the former shareholders of CaseCentral if certain SaaS revenue thresholds are exceeded achieved during the three 12-month periods starting April 1, 2012.  The fair value of this contingent consideration is determined using an expected present value technique.  Expected cash flows are determined using the probability - weighted average of possible outcomes that would occur should certain revenue metrics be reached.  There is no market data available to use in valuing the contingent consideration; therefore, the Company developed its own assumptions related to the future financial performance of the businesses to evaluate the fair value of these liabilities.  As such, the contingent consideration is classified within Level 3, as described above.

In connection with estimating the fair value of the contingent consideration, the Company developed various scenarios (base case, downside case, and upside case) and weighted each case according to the probability of occurrence. The probabilities ranged from 20 percent to 50 percent, with the most significant weighting given to the base case at 50 percent. These scenarios were developed based on the expected financial performance of CaseCentral, with SaaS revenue growth rates being a primary input in the calculation. An increase or decrease in the probability of achievement of any of the scenarios could result in a significant increase or decrease to the estimated fair value.

The fair value will be reviewed quarterly based on the financial performance of the most recently completed fiscal quarter. An analysis will also be performed at the end of each fiscal quarter to compare actual results to forecasted financial performance. If performance has deviated from projected levels, the valuation will be updated for the latest information available.

15

Table of Contents

The significant assumptions that may materially affect fair value are developed in conjunction with the guidance of our senior management to ensure that the most accurate and latest financial projections are used and compared with the most recent financial results in the fair value measurement.

The liabilities for the contingent consideration were established at the time of the consummation of the CaseCentral acquisition and will be evaluated at each reporting period.  The current liability is included in the Condensed Consolidated Balance Sheets in accrued liabilities and the non-current portion is included in contingent earn-out, net of current portion.

The fair value of the contingent consideration did not change during the period from February 21, 2012, the closing date of the acquisition to, March 31, 2012.

Note 13. Contingencies

Legal Matters

On May 20, 2011, MyKey Technology Inc. (“MyKey”) filed a complaint against us and certain other parties for patent infringement in the United States District Court for the District of Delaware.  With respect to the Company, the complaint alleges that certain of our data acquisition forensic hardware products that we acquired as a result of our acquisition of certain assets of Tableau, LLC, (“Tableau”) infringe three of MyKey’s patents relating to write blocking, duplication and data removal technologies, respectively.  The complaint seeks a declaration of infringement, a finding of willful infringement, compensatory damages, treble damages, injunctive relief, interest, expenses, costs and attorneys’ fees.

On July 22, 2011, MyKey also filed a complaint with the United States International Trade Commission (the “ITC”), alleging infringement by the Company and certain other parties of the three patents discussed in the preceding paragraph and requesting that the ITC commence an investigation pursuant to Section 337 of the Tariff Act of 1930.  The complaint seeks injunctive relief barring the Company from the importation of products that allegedly infringe the three patents of MyKey.  On August 24, 2011, the ITC commenced an investigation of the Company and certain other parties related to the complaint by MyKey. On August 31, 2011 the proceeding in the District Court was stayed pending the resolution of the ITC matter.  In April and May 2012, the ITC denied the summary disposition motions of all parties and scheduled a trial date for August 2012.

On March 19, 2012, Lone Star Document Management, LLC (“Lone Star”) filed a complaint against CaseCentral in the United States District Court for the Eastern District of Texas.  The complaint alleges that certain SaaS applications of CaseCentral, which were acquired by us as a result of our acquisition of CaseCentral, infringe one of Lone Star’s patents relating to systems for proofing and reviewing multiple versions of a document simultaneously and notes or annotations made regarding that document.  The complaint seeks a permanent injunction, compensatory damages, interest, costs and attorneys’ fees.

We intend to defend the MyKey and Lone Star matters vigorously and, at this time, are unable to estimate what, if any, liability we may have in connection with these matters.  We are unable to estimate a range of reasonably possible losses due to various reasons, including, among others, that (1) certain of the proceedings are at an early stage, (2) there is uncertainty as to the outcome of pending appeals, motions, or settlements, (3) there are significant factual issues to be resolved, (4) there are unresolved negotiations with certain indemnitors or indemnitees of the Company, related to the actions, and (5) we have meritorious defenses that we intend to assert.

From time to time, we may become involved in various other lawsuits and legal proceedings that arise in the ordinary course of business. Litigation is subject to inherent uncertainties, and an adverse result in these or other matters may arise from time to time that may harm our business. We are not currently aware of any such other legal proceedings or claims.

Indemnifications

We have agreed to indemnify our directors and executive officers for costs associated with any fees, expenses, judgments, fines and settlement amounts incurred by them in any action or proceeding to which any of them is, or is threatened to be, made a party by reason of his or her services in their role as a director or officer.

Sales Tax Liabilities

The Company’s sales and use tax filings are subject to customary audits by authorities in the jurisdictions where it conducts business in the United States, which may result in assessments of additional taxes. During the three months ended March 31, 2011, we determined that additional sales taxes were probable of being assessed by a certain state as a result of the preliminary findings specific to a sales and use tax audit. As a result, we estimated an incremental sales tax liability of approximately $1.3 million, including interest and penalties of approximately $300,000, where applicable, during the three months ended March 31, 2011. The estimated incremental sales and use tax liability was based on a similar model that was being used by the state conducting the sales and use tax audit. The estimated liability is recorded in general and administrative expenses.

16

Table of Contents

Note 14.  Stockholders’ Equity

During the three months ended March 31, 2012, as part of the purchase price of CaseCentral, the Company issued $9.5 million of Company common stock, consisting of 849,554 shares valued at the market price of $11.18 per share on the closing date of the transaction, as disclosed in Note 3.  As disclosed in Note 9, during the same period, stock options for 286,000 shares of common stock were exercised at an average price per share of $5.27, resulting in an increase in stockholders’ equity of approximately $1.5 million.  During the three months ended March 31, 2012, 188,000 restricted stock awards vested and as a result, the Company withheld 69,000 shares for tax purposes, which are included in treasury stock, resulting in a decrease to stockholders’ equity of $628,000.  In addition, as disclosed in Note 10, share-based compensation expense for the three months ended March 31, 2012 was $1,297,000.

Note 15.   Related Party Transactions

Certain of our stockholders guarantee substantially all of the obligations due under our capital and operating leases as disclosed in Note 11 of our Annual Report on Form 10-K for the year ended December 31, 2011.

Note 16. Segment Information

We have adopted Segment Reporting (ASC 280) requiring segmentation based on our internal organization and reporting of revenue and other performance measures. Our segments are designed to allocate resources internally and provide a framework to determine management responsibility. Operating segments are defined as components of an enterprise about which discrete financial information is available that is evaluated regularly by the chief operating decision maker, or decision making group, in deciding how to allocate resources and in assessing performance. Our chief operating decision maker is our Chief Executive Officer. We have four operating segments, as summarized below:

·                  Products segment—Includes EnCase® Enterprise, EnCase® eDiscovery, EnCase® Cybersecurity, EnCase® Forensic, EnCase® Portable, Premium License Support Program and hardware sales.

·                  Subscription segment—Includes subscription services for cloud-based document review and production software.  The subscription segment is new as of February 2012 due to our acquisition of CaseCentral.

·                  Services segment—Performs consulting services, implementation and training.

·                  Maintenance segment—Includes maintenance related revenue and costs.

We refer to the revenue generated by our services and maintenance segments, collectively, as services revenue. Currently, we do not separately allocate operating expenses to these segments, nor do we allocate specific assets, with the exception of goodwill, to these segments. Therefore, the segment information reported includes only revenues, cost of revenues and gross profit. The following tables present the results of operations for each operating segment:

Revenue, classified by the major geographic areas in which we operate, is as follows (in thousands):