EXECUTIVE RETENTION AND SEVERANCE PLAN

Exhibit 10.4

EXECUTIVE RETENTION AND SEVERANCE PLAN

SECTION 1. PURPOSE. The purpose of the Guidance Software, Inc. (the “Company”) Executive Retention and Severance Plan (the “Plan”) is to promote the interests of the Company and its stockholders by attracting and retaining exceptional executive personnel and other key employees of the Company. The Board of Directors of the Company recognizes that the possibility or pending occurrence of a Change in Control could lead to uncertainty regarding the consequences of such an event and could adversely affect the Company’s ability to attract, retain and motivate its officers and other key employees. “The Board of Directors has therefore determined that it is in the best interests of the Company and its stockholders to provide for the continued dedication of its officers and key employees notwithstanding the possibility or occurrence of a Change in Control by establishing this Plan to provide designated officers and key employees with enhanced financial security in the event of a Change in Control. “The Plan is designed to provide its Participants with specified compensation and benefits in the event of a Change in Control or termination of employment under circumstances specified herein upon or following a Change in Control.

SECTION 2. DEFINITIONS. As used in the Plan, the following terms shall have the meanings set forth below:

A. “Change in Control” means a Corporate Transaction other than a merger, consolidation or other capital reorganization in which the holders of more than 50% of the shares of capital stock of the Company outstanding immediately prior to such transaction continue to hold (either by the voting securities remaining outstanding or by being converted into voting securities of the surviving entity) more than 50% of the total voting power represented by the voting securities of the Company, or such surviving entity, outstanding immediately after such transaction.

B. “Constructive Termination” means Participant’s voluntary termination, upon 30 days prior written notice to the Company, within 60 days following: (1) any reduction of greater than 5% in Participant’s base compensation; (2) if the surviving entity following a Change of Control does not continue Participant’s employment in a senior position with the same or higher authority, duties, and responsibilities set forth herein for the business that constitutes the Company’s operations immediately prior to the Change in Control, or (3) if Participant is required to report for work in person on a regular and daily basis at a facility or location more than 35 miles from Participant’s current office location.

C. “Corporate Transaction” means the Company becoming majority owned by another corporation or entity, or a sale of all or substantially all of the Company’s stock or assets, or a merger, consolidation or other capital reorganization of the Company with or into another corporation.

D. “Participant” means any employee of the Company selected by the Company’s Board of Directors to be eligible to receive benefits under the Plan (and to the extent applicable, any heirs or legal representatives thereof).

E. “Participation Agreement” means an Agreement to participate in the Plan in the form attached hereto as Exhibit A or in such other form as the Board of Directors may approve from time to time; provided, however, that, after a Participation Agreement has been entered into between a Participant and the Company, it may be modified only by a supplemental written agreement executed by both the Participant and the Company.

SECTION 3. ELIGIBILITY. The Board of Directors shall designate those officers and key employees who shall be eligible to become Participants in the Plan.

SECTION 4. CHANGE OF CONTROL. Should there be a Change of Control of the Company, the following provisions will apply:

A. If, during the immediate two (2) years following such acquisition Participant’s employment relationship with the Company (or the surviving entity) is terminated by the surviving entity, or by Participant as the result of a Constructive Termination, the surviving entity shall pay Participant a lump sum, one-time payment equal to twice Participant’s base salary, grossed up to account for any Section 280G tax liability, if any (such grossed up amount, the “Change of Control Payment”) and for twenty-four (24) months after the date of such termination, the surviving entity shall continue to offer medical insurance, dental insurance, vision insurance, life insurance, and disability insurance to Participant at the same premium cost to the Participant and at the same coverage level as in effect as of the Participant’s termination of employment.

B. If Participant dies at any time during the three (3) months prior to the closing of the Change of Control, or three (3) months after the closing of the Change of Control, the Company shall make the Change of Control Payment to the estate of Participant.

C. If Participant resigns his position with the surviving entity for any reason at any time between the date six (6) months after the closing of the Change of Control and the date twelve (12) months after the closing of the Change of Control, the surviving entity shall make the Change of Control Payment to Participant.

D. The Company will inform the surviving entity, prior to the closing of the Change of Control Transaction, of the provisions of this Section 2.E., and will require such acquirer to assume this Agreement as a condition to a closing of the Change of Control.

SECTION 5. TERMINATION AND AMENDMENT OF THE PLAN. The Plan and/or any Participation Agreement executed by a Participant may not be terminated with respect to such Participant without the written consent of the Participant. The Plan and/or any Participation Agreement executed by a Participant may be modified, amended or superseded with respect to such Participant only by a supplemental written agreement between the Participant and the Company.

SECTION 6. AGREEMENT. By executing a Participation Agreement, the Participant acknowledges that the Participant has received a copy of this Plan and has read, understands and is familiar with the terms and provisions of this Plan. This Plan shall constitute an agreement between the Company and the Participant executing a Participation Agreement.

IN WITNESS WHEREOF, the undersigned Secretary of the Company certifies that the foregoing Plan was duly adopted by the Board of Directors on April 20, 2005.

Exhibit A

FORM OF AGREEMENT TO PARTICIPATE IN THE GUIDANCE SOFTWARE, INC.

EXECUTIVE RETENTION AND SEVERANCE PLAN

Agreement to Participate in the Guidance Software, Inc. Executive Retention and Severance Plan

In consideration of the benefits provided by the Guidance Software, Inc. (the “Company”) Executive Retention and Severance Plan (the “Plan”), the undersigned employee of the Company and the Company agree that, as of the date written below, the undersigned shall become a Participant in the Plan and shall be fully bound by and subject to all of its provisions. All references to a “Participant” in the Plan shall be deemed to refer to the undersigned.

The undersigned employee acknowledges that the Plan confers significant legal rights and may also constitute a waiver of rights under other agreements with the Company; that Company has encouraged the undersigned to consult with the undersigned’s personal legal and financial advisers; and that the undersigned has had adequate time to consult with the undersigned’s advisers before executing this agreement.

The undersigned employee acknowledges that he or she has received a copy of the Plan and has read, understands and is familiar with the terms and provisions of the Plan. The undersigned employee further acknowledges that, except as otherwise established in an employment agreement between the Company and the undersigned, if any, the employment relationship between the undersigned and the Company is an “at-will” relationship.