GUIDANCE SOFTWARE, INC. FIRST AMENDED AND RESTATED 2004 EQUITY INCENTIVE PLAN

Exhibit 10.9

GUIDANCE SOFTWARE, INC.

FIRST AMENDED AND RESTATED 2004 EQUITY INCENTIVE PLAN

AMENDED AND RESTATED STOCK OPTION AGREEMENT

THIS AMENDED AND RESTATED STOCK OPTION AGREEMENT (this “Agreement”), effective as of January 19, 2008 is made by and between Guidance Software, Inc., a Delaware corporation (the “Company”), and Victor Limongelli (“Optionee”). This Agreement amends and restates in its entirety that certain Stock Option Agreement entered into by and between the Company and Optionee, dated as of December 6, 2007 (the “Original Stock Option Agreement”). All capitalized terms used in this Agreement without definition shall have the meanings ascribed to such terms in the Guidance Software, Inc. First Amended and Restated 2004 Equity Incentive Plan (the “Plan”).

WHEREAS, pursuant to the Original Stock Option Agreement, the Company granted Optionee an option to purchase 500,000 Shares (the “Original Option”);

WHEREAS, the Company and Optionee mutually desire to cancel that portion of the Original Option covering 300,000 Shares;

WHEREAS, the cancellation of such portion of the Original Option shall not affect the remaining portion of the Original Option covering 200,000 Shares, and such portion of the Original Option shall remain in full force and effect.

NOW, THEREFORE, in consideration of the covenants and undertakings herein, and for other good and valuable consideration, the sufficiency of which is hereby acknowledged, the Company and Optionee hereby agree as follows:

(a) The portion of the Original Option covering 300,000 Shares (the “Cancelled Option”), and all of Optionee’s rights and interest with respect to the Cancelled Option are hereby cancelled and terminated and shall be deemed null and void and of no force or effect.

(b) The remaining portion of the Original Option covering 200,000 Shares shall remain unchanged and shall remain in full force and effect as of the Date of Grant pursuant to the terms of this Agreement.

(c) For purposes of this Agreement, the “Option” shall refer to that portion of the Original Option covering the 200,000 Shares not cancelled pursuant to this Article I.

Victor Limongelli

[Optionee Address]

You (“Optionee”) have been granted an option (the “Option”) to purchase Common Stock of the Company, subject to the terms and conditions of the Plan and this Agreement. The terms of your grant are set forth below:

Vesting Schedule:

The Option shall vest as follows:

(i) In the event that the closing trading price of a share of Common Stock on the principal stock exchange or quotation system on which the Common Stock is then listed (the “Principal Exchange”) equals or exceeds $15.36 on each trading day during a period of at least sixty (60) consecutive trading days, the Option shall, as of the last trading day of such sixty day period, vest and become exercisable with respect a number of shares such that an aggregate of twenty-five percent (25%) of the Option is vested and exercisable as of such date;

(ii) In the event that the closing trading price of a share of Common Stock on the Principal Exchange equals or exceeds $17.92 on each trading day during a period of at least sixty (60) consecutive trading days, the Option shall, as of the last trading day of such sixty day period, vest and become exercisable with respect a number of shares such that an aggregate of fifty percent (50%) of the Option is vested and exercisable as of such date;

(iii) In the event that the closing trading price of a share of Common Stock on the Principal Exchange equals or exceeds $20.48 on each trading day during a period of at least sixty (60) consecutive trading days, the Option shall, as of the last trading day of such sixty day period, vest and become exercisable with respect a number of shares such that an aggregate of seventy-five percent (75%) of the Option is vested and exercisable as of such date; and

(iv) In the event that the closing trading price of a share of Common Stock on the Principal Exchange equals or exceeds $23.04 on each trading day during a period of at least sixty (60) consecutive trading days, the Option shall, as of the last trading day of such sixty day period, vest and become exercisable with respect a number of shares such that an aggregate of one hundred percent (100%) of the Option is vested and exercisable as of such date.

2

The Option shall be subject to accelerated vesting as set forth in Section 2(b) below.

Exercisability Period:

Except in the event of a termination of Optionee’s service by the Company for Cause, the Option may be exercised, to the extent vested, for ninety (90) days after Optionee ceases to be a Service Provider or ninety (90) days after the Non-CEO Date (as defined below), as applicable, or such longer period as may be applicable upon the death or disability of Optionee as provided herein (or, if not provided herein, then as provided in the Plan), but in no event later than the Term/Expiration Date as provided above. Notwithstanding the foregoing, if the exercise of the Option following termination of Optionee’s service or following the Non-CEO Date, as applicable, or the tender of already-owned Shares or the sale of Shares through a broker in connection with such exercise would violate applicable federal or state securities laws, then the Option may be exercised until the expiration of a period of ninety (90) days following the first date on which the exercise of the Option (or such tender of already-owned Shares or sale of Shares) would not be in violation of such securities laws, but in no event later than the Term/Expiration Date as provided above.

1. Grant of Option. The Company has granted to Optionee an Option to purchase the Common Stock (the “Shares”) set forth in the Notice of Grant, at the exercise price per Share set forth in the Notice of Grant (the “Exercise Price”). Notwithstanding anything to the contrary anywhere else in this Agreement, the Option is subject to the terms, definitions and provisions of the Plan, which is incorporated herein by reference.

If designated in the Notice of Grant as an Incentive Stock Option, the Option is intended to qualify as an incentive stock option as defined in Section 422 of the Code; provided, however, that to the extent that the aggregate Fair Market Value of stock with respect to which incentive stock options (within the meaning of Code Section 422, but without regard to Code Section 422(d)), including the Option, are exercisable for the first time by Optionee during any calendar year (under the Plan and all other incentive stock option plans of the Company or any “parent corporation” or “subsidiary corporation” thereof within the meaning of Section 424(e) and 424(f), respectively, of the Code) exceeds $100,000, such options shall be treated as not qualifying under Code Section 422, but rather shall be treated as Non-Qualified Stock Options to the extent required by Code Section 422. The rule set forth in the preceding sentence shall be applied by taking options into account in the order in which they were granted. For purposes of these rules, the Fair Market Value of stock shall be determined as of the time the option with respect to such stock is granted.

2. Exercise of Option. The Option is exercisable as follows:

(a) Right to Exercise.

(i) The Option shall be exercisable according to the vesting schedule set forth in the Notice of Grant. For purposes of this Agreement, Shares subject to the Option shall vest based on Optionee’s continued status as a Service Provider, subject, however, to Section 2(b) below.

3

(ii) The Option may not be exercised for a fraction of a Share.

(iii) In the event of Optionee’s death, disability or other termination of Optionee’s status as a Service Provider or status as the Chief Executive Officer of the Company, the exercisability of the Option is governed by Sections 7, 8, 9 and 10 below.

(iv) In no event may the Option be exercised after the date of expiration of the Term/Expiration Date of the Option as set forth in the Notice of Grant.

(b) Vesting upon Termination of Employment or Acquisition. In the event that (i) Optionee’s employment with the Company is terminated by the Company without Cause or by Optionee for Good Reason (as defined in that certain Employment Agreement, dated as of December 6, 2007, by and between the Company and Optionee), or (ii) an Acquisition occurs (in any case, a “Triggering Event”), then, provided that the Option has not yet expired, the Option shall vest and become exercisable as follows:

(i) In the event that the closing trading price of a share of Common Stock on the Principal Exchange equals or exceeds $15.36 on the date immediately prior to the date on which the Triggering Event occurs, the Option shall, immediately prior to the Triggering Event, vest and become exercisable with respect a number of shares such that an aggregate of twenty-five percent (25%) of the Option is vested and exercisable as of such date;

(ii) In the event that the closing trading price of a share of Common Stock on the Principal Exchange equals or exceeds $17.92 on the date immediately prior to the date on which the Triggering Event occurs, the Option shall, immediately prior to the Triggering Event, vest and become exercisable with respect a number of shares such that an aggregate of fifty percent (50%) of the Option is vested and exercisable as of such date;

(iii) In the event that the closing trading price of a share of Common Stock on the Principal Exchange equals or exceeds $20.48 on the date immediately prior to the date on which the Triggering Event occurs, the Option shall, immediately prior to the Triggering Event, vest and become exercisable with respect a number of shares such that an aggregate of seventy-five percent (75%) of the Option is vested and exercisable as of such date; and

(iv) In the event that the closing trading price of a share of Common Stock on the Principal Exchange equals or exceeds $23.04 on the date immediately prior to the date on which the Triggering Event occurs, the Option shall, immediately prior to the Triggering Event, vest and become exercisable with respect a number of shares such that an aggregate of one hundred percent (100%) of the Option is vested and exercisable as of such date.

(c) Method of Exercise. The Option shall be exercisable by written notice in a form prescribed by the Company. The notice must state the number of Shares for which the Option is being exercised, and such other representations and agreements with respect to such Shares as may be required by the Company pursuant to the provisions of the Plan. The notice

4

must be signed by Optionee and shall be delivered in person or by certified mail to the Secretary of the Company. The notice must be accompanied by payment of the Exercise Price, including payment of any applicable withholding tax. The Option shall be deemed to be exercised upon receipt by the Company of such written notice accompanied by the Exercise Price and payment of any applicable withholding tax.

No Shares shall be issued pursuant to the exercise of an Option unless such issuance and such exercise comply with all relevant provisions of law and the requirements of any stock exchange upon which the Shares may then be listed. Assuming such compliance, for income tax purposes the Shares shall be considered transferred to Optionee on the date on which the Option is exercised with respect to such Shares.

3. Method of Payment. Payment of the Exercise Price shall be by any of the following, or a combination thereof, at the election of Optionee (a) cash, (b) check, or (c) to the extent that such payment method does not result in adverse accounting consequences to the Company, (1) Shares owned by Optionee or issuable upon exercise of the Option, in each case having a Fair Market Value on the date of delivery equal to the aggregate exercise price of the Option or exercised portion thereof, (2) delivery of a notice that Optionee has placed a market sell order with a broker with respect to Shares then issuable upon exercise of the Options and that the broker has been directed to pay a sufficient portion of the net proceeds of the sale to the Company in satisfaction of the Option exercise price, provided that payment of such proceeds is then made to the Company upon settlement of such sale, or (3) any combination of the foregoing methods of payment.

4. Transfer Restriction. With respect to any Shares acquired upon exercise of the Option, Optionee hereby agrees that he shall not sell or otherwise transfer such Shares during the period (the “Restricted Period”) ending on the earliest to occur of (i) the two year anniversary of the date on which the Option is exercised with respect to such Shares, (ii) the date on which Optionee ceases to be a Service Provider by reason of a termination of Optionee’s service by the Company without Cause or by Optionee for Good Reason, (iii) the date of Optionee’s death, or (iv) immediately prior to an Acquisition; provided, however, that such restriction shall not apply to any Shares delivered to (or withheld by) the Company as payment of the Exercise Price or in satisfaction of Optionee’s tax withholding obligations. The Company may impose stop-transfer instructions with respect to securities subject to the foregoing restrictions until the end of such Restricted Period.

5. Termination of Relationship. In the event that (i) Optionee ceases to be a Service Provider (other than by reason of a termination by the Company for Cause or Optionee’s death or the total and permanent disability of Optionee as defined in Code Section 22(e)(3)), or (ii) Optionee ceases for any reason to serve as the Company’s Chief Executive Officer but remains employed by the Company, the Option, to the extent vested as of the date on which Optionee ceases to be a Service Provider or the date on which Optionee ceases to serve as the Company’s Chief Executive Officer but remains employed by the Company (the “Non-CEO Date”), as applicable, shall remain exercisable during the Exercisability Period set forth in the Notice of Grant. To the extent that the Option is not vested as of the date on which Optionee ceases to be a Service Provider or as of the Non-CEO Date, as applicable, or if Optionee does not exercise the Option within the time specified herein, the Option shall terminate.

5

6. Termination for Cause. If Optionee ceases to be a Service Provider by reason of a termination by the Company for Cause, the Option shall terminate upon the date of Optionee’s termination, regardless of whether the Option is then vested and/or exercisable with respect to any Shares.

7. Disability of Optionee. If Optionee ceases to be a Service Provider as a result of his or her total and permanent disability as defined in Code Section 22(e)(3), the Option, to the extent vested as of the date on which Optionee ceases to be a Service Provider, shall remain exercisable for twelve (12) months from such date (but in no event later than the expiration date of the term of the Option as set forth in the Notice of Grant). To the extent that the Option is not vested as of the date on which Optionee ceases to be a Service Provider, or if Optionee does not exercise such Option within the time specified herein, the Option shall terminate.

8. Death of Optionee. If Optionee ceases to be a Service Provider as a result of Optionee’s death, the Option, to the extent vested as of the date of death, shall remain exercisable for twelve (12) months following the date of death (but in no event later than the expiration date of the term of the Option as set forth in the Notice of Grant) by Optionee’s estate or by a person who acquires the right to exercise the Option by bequest or inheritance. To the extent that the Option is not vested as of the date of death, or if the Option is not exercised within the time specified herein, the Option shall terminate.

9. Non-Transferability of Option. The Option may not be transferred in any manner except by will or by the laws of descent or distribution. It may be exercised during the lifetime of Optionee only by Optionee. The terms of the Option shall be binding upon the executors, administrators, heirs, successors and assigns of Optionee.

10. Term of Option. The Option may be exercised only within the term set forth in the Notice of Grant.

11. No Right to Employment. Nothing in the Plan or in this Agreement shall confer upon Optionee any right to continue in the employ of, or as a Consultant for, the Company or any Parent or Subsidiary, or as a director of the Company, or shall interfere with or restrict in any way the rights of the Company or any Parent or Subsidiary, which are hereby expressly reserved, to discharge Optionee at any time for any reason whatsoever, with or without Cause, except to the extent expressly provided otherwise in a written employment agreement between Optionee and the Company or any Parent or Subsidiary.

12. Miscellaneous.

(a) Governing Law; Severability. The laws of the State of California shall govern the interpretation, validity, administration, enforcement and performance of the terms of this Agreement regardless of the law that might be applied under principles of conflicts of laws.

(b) Conformity to Securities Laws. Optionee acknowledges that the Plan and this Agreement are intended to conform to the extent necessary with all provisions of the Securities Act and the Exchange Act and any and all regulations and rules promulgated by the Securities and Exchange Commission thereunder, and state securities laws and regulations. Notwithstanding anything herein to the contrary, the Plan shall be administered, and the Option is granted and may be exercised, only in such a manner as to conform to such laws, rules and

6

regulations. To the extent permitted by applicable law, the Plan and this Agreement shall be deemed amended to the extent necessary to conform to such laws, rules and regulations.

(c) Amendments, Suspension and Termination. To the extent permitted by the Plan, this Agreement may be wholly or partially amended or otherwise modified, suspended or terminated at any time or from time to time by the Administrator, provided, that, except as may otherwise be provided by the Plan, no amendment, modification, suspension or termination of this Agreement shall adversely effect the Option in any material way without the prior written consent of Optionee.

(d) Notification of Disposition. If this Option is designated as an Incentive Stock Option, Optionee shall give prompt notice to the Company of any disposition or other transfer of any Shares acquired under this Agreement if such disposition or transfer is made (a) within two years after the Date of Grant set forth in the Notice of Grant or (b) within one year after the transfer of such Shares to Optionee upon exercise of the Option. Such notice shall specify the date of such disposition or other transfer and the amount realized, in cash, other property, assumption of indebtedness or other consideration, by the Participant in such disposition or other transfer.

(e) Limitations Applicable to Section 16 Persons. Notwithstanding any other provision of the Plan or this Agreement, if Optionee is subject to Section 16 of the Exchange Act, the Plan, the Option and this Agreement shall be subject to any additional limitations set forth in any applicable exemptive rule under Section 16 of the Exchange Act (including any amendment to Rule 16b-3 of the Exchange Act) that are requirements for the application of such exemptive rule. To the extent permitted by applicable law, this Agreement shall be deemed amended to the extent necessary to conform to such applicable exemptive rule.

(f) Section 409A. This Agreement and the Option is intended to be exempt from the provisions of Section 409A of the Code and Department of Treasury regulations and other interpretive guidance issued thereunder, as providing for an option to purchase service recipient stock as described in Section 1.409A-l(b)(5)(i)(A) of the Department of Treasury regulations. Notwithstanding any provision of this Agreement to the contrary, in the event that the Administrator determines that the Option may be subject to Section 409A of the Code, the Administrator may adopt such amendments to this Agreement or adopt other policies and procedures (including amendments, policies and procedures with retroactive effect), or take any other actions, that the Administrator determines are necessary or appropriate to (a) exempt the Option from Section 409A of the Code and/or preserve the intended tax treatment of the benefits provided with respect to the Option, or (b) comply with the requirements of Section 409A of the Code and related Department of Treasury guidance and thereby avoid the application of penalty taxes under Section 409A of the Code.

[SIGNATURE PAGE FOLLOWS]

7

This Agreement may be executed in two or more counterparts, each of which shall be deemed an original and all of which shall constitute one document.

OPTIONEE ACKNOWLEDGES AND AGREES THAT, SUBJECT TO SECTION 2(b) ABOVE, THE VESTING OF SHARES PURSUANT TO THE OPTION HEREOF IS EARNED ONLY BY CONTINUING EMPLOYMENT, DIRECTORSHIP OR CONSULTANCY AT THE WILL OF THE COMPANY (NOT THROUGH THE ACT OF BEING HIRED, BEING GRANTED THE OPTION OR ACQUIRING SHARES HEREUNDER). OPTIONEE FURTHER ACKNOWLEDGES AND AGREES THAT NOTHING IN THIS AGREEMENT, NOR IN THE COMPANY’S 2004 EQUITY INCENTIVE PLAN WHICH IS INCORPORATED HEREIN BY REFERENCE, SHALL CONFER UPON OPTIONEE ANY RIGHT WITH RESPECT TO CONTINUATION OF EMPLOYMENT, DIRECTORSHIP OR CONSULTANCY BY THE COMPANY, NOR SHALL IT INTERFERE IN ANY WAY WITH OPTIONEE’S RIGHT OR THE COMPANY’S RIGHT TO TERMINATE OPTIONEE’S EMPLOYMENT, DIRECTORSHIP OR CONSULTANCY AT ANY TIME, WITH OR WITHOUT CAUSE.

Optionee acknowledges receipt of a copy of the Plan and represents that he or she is familiar with the terms and provisions thereof. Optionee hereby accepts the Option subject to all of the terms and provisions hereof. Optionee has reviewed the Plan and the Option in their entirety, has had an opportunity to obtain the advice of counsel prior to executing the Option and fully understands all provisions of the Option. Optionee hereby agrees to accept as binding, conclusive and final all decisions or interpretations of the Administrator upon any questions arising under the Plan or the Option. Optionee further agrees to notify the Company upon any change in the residence address indicated below.

8