AMENDMENT TWO to the ORACLE PARTNERNETWORK EMBEDDED SOFTWARE LICENSE DISTRIBUTION AGREEMENT between GUIDANCE SOFTWARE, INC. AND ORACLE AMERICA, INC.

Exhibit 10.11

AMENDMENT TWO

to the

ORACLE PARTNERNETWORK

EMBEDDED SOFTWARE LICENSE DISTRIBUTION AGREEMENT

between

GUIDANCE SOFTWARE, INC.

AND

ORACLE AMERICA, INC.

This document (“Amendment Two”) amends the Oracle PartnerNetwork Embedded Software License Distribution Agreement (US-OPN-EMBD-12147270-28-Nov-08) between Guidance Software, Inc. (“you” and “your”) and Oracle America, Inc. (“Oracle”), dated November 28, 2008 and any and all amendments thereto (the “agreement”).

The parties hereby agree to amend the agreement as follows:

1.              In Section A (Agreement Definitions):

a.              Delete the first paragraph of the section and replace it with the following:

“You” and “your” refer to the entity that has entered into this agreement with Oracle America, Inc. (“Oracle”) to distribute Oracle’s programs with your application program and your wholly and majority owned subsidiaries that you bind to this agreement (“subsidiary”). You warrant that you have the authority to bind your subsidiaries to the terms of this agreement and any applicable order with Oracle and/or report and further warrant that you shall be responsible for a breach of such terms by your subsidiaries.”

b.              Delete subsection (vi) in its entirety.

c.               Delete the first sentence after subpart (xi) and replace it with the following:

“The term “end user” refers to a third party that is licensed to use the application package for its own internal business operations subject to the terms of an end user license agreement as further provided for in this agreement. End user shall not include any public sector entity.”

d.              Delete the 8th - 11th sentences after subpart (xi) and replace them with the following:

“The term “programs” refers to the software products owned or distributed by Oracle (including program documentation and any program updates acquired through technical support) that are set forth on the Oracle Embedded Product and Royalty Matrix and specified on the application package registration form. The term “programs” does not include any Oracle programs which are not included on the Oracle Embedded Product and Royalty Matrix. You may access the Oracle Embedded Product and Royalty Matrix at http://partner.oracle.com (log in, select Membership / Agreements & Policies). The term “program documentation” refers to the program user manual and program installation manuals. Program documentation for the programs you distribute is delivered with the programs, or the documentation may be accessed online at http://oracle.com/contracts. The term “public sector entity” is any government, legislature or decision making body, judiciary, instrumentality, department, or agency at any level (national, local, municipal or otherwise); entities managed, controlled or majority owned by government interests; public organizations or foundations of any kind (including political parties, political organizations, or political candidates); and any public international organization, such as, but not limited to, the International Red Cross, United Nations, or the World Bank.”

2.              In Section B (Distribution Rights):

a. Delete the first paragraph of the section and replace it with the following:

“In order to distribute programs, you and your subsidiaries must be members of the Oracle PartnerNetwork. Oracle grants you a nonexclusive, nontransferable right to (a) to duplicate the programs for which you have received a development license under an Oracle PartnerNetwork Agreement between you and Oracle and (b) to distribute such programs to end users as part of the application package. The programs must be embedded with your application program and distributed with your application program and cannot be provided separately. Prior to distributing programs, you must obtain an order from the end user for the programs, which order and programs shall be subject to a valid end user license agreement. Each distributed embedded program must be used only for the internal business operations of the end user and must be used only in conjunction with the application package. Each distributed embedded program shall be subject to the terms of this agreement and the terms provided in the end user license agreement. You may distribute the application package to yourself or your affiliated entities and you and any such entity shall be considered an end user under this agreement provided that (1) you comply with the requirements of Section G (License Agreement), and (2) you report such distribution in accordance with Section F (Reporting). You may not distribute the programs, learning credits, and/or services to end users that are public sector entities. The total fees paid to Oracle for distribution of the application package to you and any affiliated entities may not exceed 20% of the total fees paid to Oracle under this agreement. Oracle may disclose information about the rights granted to you pursuant to this agreement to an Oracle Value Added Distributor (“Oracle VAD”). Oracle shall inform you of any notices and other instructions that are related to third party software components (including open source software) that are included in a program and that Oracle is required to distribute with such programs. These notices and other instructions shall be provided to you in at least one of the following ways, at Oracle’s sole discretion: (a) automatically installed with the programs or in the installation details; (b) in the program documentation; (c) in the readme files; or (d) via a supplemental list. You shall comply with all other instructions related to third party software components (including open source software) and you shall reproduce all third party notices in an appropriate location in the application package and/or in its related documentation and include any associated source code as required by the applicable notices or as otherwise directed by Oracle. You must provide the following legend on the installation pop-up screen of the application package, or if the application package is a physical device, you must provide the legend on the label for the media containing the programs and your application program: “The programs included herein are subject to a restricted use license and can only be used in conjunction with this application.”

b. Delete the last sentence of the second paragraph and replace it with the following:

“You must provide the following legend, or direct link to the legend, on the installation pop-up screen of the application package, or if the application package is a physical device, you must provide the legend on the label for the media containing the programs and your application program: “The programs included herein are subject to a restricted use license and can only be used in conjunction with this application.”

3.              In Section E (Ownerships and Restrictions), delete the first three paragraphs of the section and replace them with the following:

“Oracle or its licensors retain all ownership and intellectual property rights to the programs. Oracle retains all ownership and intellectual property rights to anything developed by Oracle and/or

delivered to you under this agreement. Each end user may make a sufficient number of copies of each program for the licensed use and one copy of each program media. All other rights are reserved, and this agreement does not grant any rights, whether by implication, estoppel, or otherwise, other than those rights specifically described in this agreement.

The programs may contain third party technology. Third party technology will be licensed to you either under the terms of this agreement or, if specified in the program documentation, readme files, or the installation details or otherwise as set forth in section B, under separate license terms (“separate terms”) and not under the terms of this agreement (“separately licensed third party technology”). Further, Oracle is required in certain cases to provide notices to you and will do so in accordance with the terms of section B. For clarity, the mere existence of such a notice will not change the terms under which third party technology is licensed to you.

Your rights to use (including without limitation the right to distribute) separately licensed third party technology under the separate terms are not restricted in any way by this agreement. However, solely with respect to separately licensed third party technology that is part of the program, and is used: (i) in unmodified form; (ii) as part of the program; (iii) in accordance with the license grant for the relevant program and all other terms and conditions of this agreement, and (iv) in compliance with the separate terms, Oracle will provide indemnification for separately licensed third party technology to the same extent as Oracle is required to provide indemnification for the program under the terms of this agreement. Oracle will provide indemnification for third party technology that is part of the program and not separately licensed third party technology to the same extent as Oracle is required to provide indemnification for the program under the terms of this agreement.”

4.              In the first paragraph of section F (Reporting) add the following after the second sentence:

“Notwithstanding anything to the contrary in the Partner Ordering Policy, where an end user prohibits you from providing such end users’ name, address, and email address information to Oracle pursuant to a valid agreement between you and such end user, you may provide a unique identifier for each end user in lieu of the data elements required in the Partner Ordering Policy of end user name, address and email address. Such unique identifier shall include not less than the state and zip code (or country and postal code, if the end user is not located in the United States) where the end user resides. You agree to maintain a listing of such unique identifiers and the corresponding end user name, addresses, and email addresses to disclose to Oracle as part of an audit pursuant to Section V of this agreement and/or upon Oracle’s request in the event of an alleged breach of the end user license agreement by the end user. Additionally, for any specified unique identifier, you agree that at Oracle’s request you will confirm whether or not such unique identifier represents any company or commercial entity listed on a customer list provided by Oracle.”

5.              In Section G (License Agreement):

a.              Delete the first sentence of the section and replace it with the following:

“It is your responsibility to ensure that any distribution of the programs and/or services to an end user is subject to a legally binding end user license agreement.”

b.              Delete subsection (1) and replace it with the following:

“(1) limit the use of the programs to the legal entity and the legal entity’s wholly and majority owned subsidiaries and affiliates, provided that such wholly owned subsidiaries and affiliates agree to be bound by the terms of the end user license agreement and the legal entity that signed the end user license agreement is financially responsible for any damages caused by such wholly and majority owned subsidiaries and affiliates.”

c.               Add the following new subsections after subsection (1) (to be inserted as subsections 2 and 3 respectively):

i.          “(2) restrict use of the programs to the scope of the application package and to the internal business operations of the end user. You may allow your end users to permit agents or contractors (including, without limitation, outsourcers) to use the application package on the applicable end user’s behalf for the end user’s internal business operations as described above, subject to the terms of the end user license agreement. For an application package that includes programs that are specifically designed to facilitate interactions between the end user and the end user’s customers and suppliers, you may allow the end user to permit its customers and suppliers to use the application package in furtherance of such interactions subject to the end user license agreement. The end user license agreement shall require the end user to be responsible for its agent’s, contractor’s, outsourcer’s, customer’s and supplier’s use of the application package and compliance with the end user license agreement. For purposes of clarification, both parties acknowledge that the EnCase Enterprise Examiner and the EnCase Concurrent Connection application packages may be installed and run by an end user on computers of such end user’s consulting clients.

ii.               “(3) state that all third party software vendors and licensors retain all ownership and intellectual property rights to the programs.”

d.              Delete subsection (2) and replace with the following (to be inserted as subsection 4):

“prohibit (a) the transfer of the programs except for temporary transfer in the event of computer malfunction if the application package embeds the programs in a physical device and (b) the end user from assigning, giving, or transferring the programs and/or any services ordered or an interest in them to another individual or entity (and if your end user grants a security interest in the programs and/or any services, the secured party has no right to use or transfer the programs and/or any services), provided that notwithstanding the foregoing, the end user may assign its rights to use the programs under the end user license agreement to an entity that is not a competitor of Oracle’s that agrees in writing to the terms and conditions of the end user license agreement. No more than once per annual period during the term of this agreement, and subject to Oracle providing written request to you at least 30 days in advance, you agree to use commercially reasonable efforts to produce an annual report indicating the number of end user licenses assigned in each annual period. For clarification, if the report is not 100% accurate it will not be considered a breach of this agreement so long as you use commercially reasonable efforts.”

e.               Add the following new subsection after subsection (2) (to be inserted as subsection 5):

“prohibit (a) use of the programs for rental, timesharing, subscription service, hosting, or outsourcing; (b) the removal or modification of any program markings or any notice of Oracle’s or its licensors’ proprietary rights; (c) the end user from making the programs available in any manner to any third party for use in the third party’s business operations (unless such access is expressly permitted for the specific program license); and (d) title to the programs from passing to the end user or any other party; the prohibition herein against providing “subscription licenses” shall not restrict you from distributing successive or periodic term licenses of the EnCase Enterprise Examiner application package to an end user on an end user license agreement with an auto-renewal or auto-extension of term basis, provided that in such case the end user is always the licensee if such license

pursuant to all the terms of this agreement and in no event shall the terms of this agreement be construed to grant you (as a licensee) any form of license to use the programs on behalf of the end user where such end user is not the licensee.”

f.                Delete subsection (3) and replace it with the following (to be inserted as subsection 6):

“prohibit the reverse engineering (unless required by law for interoperability), disassembly or decompilation of the programs (the foregoing prohibition includes but is not limited to review of data structures or similar materials produced by programs) and prohibit duplication of the programs except for a sufficient number of copies of each program for the end user’s licensed use and one copy of each program media”

g.               Delete subsection (4) and replace it with the following (to be inserted as subsection 7):

“disclaim, to the extent permitted by applicable law, Oracle’s liability for (a) any damages, whether direct, indirect, incidental, special, punitive or consequential, and (b) any loss of profits, revenue, data or data use, arising from the use of the programs.”

h.              Renumber sections 5, 6, 7, 8 and 9 to sections 8, 9, 10, 11 and 12 respectively.

i.                  Delete subsection (10) and replace it with the following (to be inserted as subsection 13):

“permit you to audit your end user’s use of the programs.”

j.                 Renumber sections 11, 12 and 13 to sections 14, 15 and 16 respectively.

k.              Delete the first sentence of the second paragraph and replace it with the following (to be inserted as subsection 17):

“state that third party technology that may be appropriate or necessary for use with some Oracle programs is specified in the application package documentation or as otherwise notified by you and that such third party technology is licensed to the end user only for use with the application package under the terms of the third party license agreement specified in the application package documentation or as otherwise notified by you and not under the terms of the end user license agreement.”

6.              In Section H (Fees and Taxes):

a.              In the sixth sentence of the section delete the phrase “Oracle Technology global price list” and replace it with the phrase “Oracle Embedded Product and Royalty Matrix”.

b.              Delete the fifteenth sentence of the section and replace it with the following:

“If you select option (a), if Oracle’s Embedded Product and Royalty Matrix changes after you issue a valid written quote for program licenses to an end user, for 90 days after the date you submit the quote to the end user, the fee applicable to the programs identified in the quote shall be based on the Oracle Embedded Product and Royalty Matrix in effect on the date you submitted the quote to the end user.”

7.              In Section I (Warranties, Disclaimers, and Exclusive Remedies):

a.              Delete the first two sentences of the section and replace them with the following:

“Oracle warrants to you that a program will operate in all material respects as described in the applicable program documentation for one year from delivery (i.e. via physical shipment or electronic download) to the end user. You must notify Oracle of any program warranty deficiency within one year from such delivery.”

b.             In the sixth sentence of the section delete phrase “THE RELEVANT” and the phrase “THE DEFICIENT” and replace each with the term “THOSE” (a total of two replacements).

8.              In Section J (Indemnification),

a.              Delete the third bullet point and replace it with the following:

“give Oracle the reasonable information, authority, and reasonable assistance Oracle needs to defend against or settle the claim.”

b.              Delete each instance of the phrase “have paid” and replace it with “have paid to Oracle” (a total of 2 replacements).

9.              In Section L (Term and End of Agreement),

a.              Delete the second sentence and replace it with the following:

“The term of this agreement shall continue through and until November 27, 2015. Notwithstanding anything to the contrary, in the event that the term of this agreement expires before the term of the Outside In Prepaid Royalty Addendum dated February 29, 2012 [to be completed by Oracle] then the term of this agreement shall be extended for the remainder of the term of the Outside In Prepaid Royalty Addendum only. Distributions outside of the terms of the Outside In Prepaid Royalty Addendum dated February 29, 2012[to be completed by Oracle] would be subject to execution of a new Embedded Software License Distribution Agreement.”

b.              In the sixth and seventh sentences of the section, delete each instance of the phrase “30 days” and replace them with the phrase “30 days from notification of termination” (a total of 2 replacements).

10.       In Section M (Nondisclosure), delete the last paragraph of the section and replace it with the following:

“We each agree to hold each other’s confidential information in confidence for a period of three years from the date of disclosure. Also, we agree to disclose confidential information only to those employees or agents who are required to protect it against unauthorized disclosure. In addition, you agree that you may not disclose to investors or potential investors information regarding Oracle’s financial performance or your company’s financial performance specifically related to Oracle programs and/or services without prior written consent from Oracle’s Investor Relations group. Nothing shall prevent (1) either party from disclosing the terms or pricing under this agreement or orders or reports submitted under this agreement in any legal proceeding arising from or in connection with the terms of this agreement or (2) Oracle from disclosing to an Oracle VAD information about the status of your membership in the Oracle PartnerNetwork or the programs that you are permitted to distribute under this agreement, or (3) either party from disclosing the confidential information to a federal or state governmental entity as required by law. If either party receives a subpoena or other validly issued administrative or judicial process demanding confidential information of the other party, then, if permitted by law, the recipient will use

reasonable efforts to promptly notify the other party of such demand. The other party may, at its sole expense, seek to limit, quash or extend such demand. Unless such demand shall have been timely quashed, the recipient shall comply with such demand including extensions or limitations thereto, if any, ordered under such administrative or judicial process.”

11.       In Section P (Privacy):

a.              Delete the first paragraph of the section and replace it with the following:

“If you provide Oracle with personal information concerning your customers, prospects or employees, Oracle will only use the information in manners consistent with those specified in this agreement to accomplish their purposes, or as otherwise indicated at the time Oracle collects such information. This information may be maintained by Oracle in data centers in the United States and may be accessed by Oracle’s global personnel as required for business purposes. You agree to provide all relevant notices and obtain any consents required to share the information with Oracle.”

b.              Delete the second paragraph of the section and replace it with the following:

“If Oracle provides you with personal information concerning Oracle’s partners, customers, prospects or employees you agree that you will permit access to and use of such information solely in connection with the sale of Oracle products or services and for the limited purpose(s) for which it was provided by Oracle under this agreement. You also agree to comply with all laws that apply to your use of this information for such purposes. The requirements of this section do not apply to either party’s relationships with its customers.”

c.               Delete the third paragraph of the section and replace it with the following:

“From time to time, the parties may exchange information regarding marketing and sales opportunities through Oracle’s Partner Management application. Both parties agree to use any such information in compliance with the terms of this agreement and Oracle’s Partner Management Opportunity Routing Policy the current version of which is located at http://partner.oracle.com (log in, select Membership / Agreements & Policies).”

12.       Delete Section R (U.S. Government End Users) in its entirety.

13.       In Section S (Ethical Business Practices),

a.              Delete the first and second sentences of the section and replace them with the following:

“You acknowledge and agree that you and your owners, directors, officers, employees or agents have not, and will not, make or promise to make corrupt payments of money or anything of value, directly or indirectly, to any government or public international organization officials, political parties, or candidates for political office, or employee of a commercial customer or supplier, for the purpose of obtaining or retaining business or securing any improper advantage. You agree to accurately document all transactions related to this agreement in your financial books, records, statements, and in reports or other documents provided to Oracle.”

b.              Delete the fourth sentence of the section and replace it with the following:

“You agree that any violation of this section constitutes just cause for the immediate termination by Oracle of this agreement without any liability incurred by Oracle to you.”

14.       In Section W (Other):

a.              Delete subsection (2) and replace it with the following:

“If you have a dispute with Oracle or if you wish to provide a notice under Section J (Indemnification) of this agreement, or if you become subject to insolvency or other similar legal proceedings, you will promptly send written notice to Oracle America, Inc., 500 Oracle Parkway, Redwood Shores, California 94065, Attn: General Counsel.”

b.              In subsection (5), delete the first sentence and replace it with the following:

“You agree that you will keep accurate books and records in connection with the activities under this agreement.”

15.       In Section X (Force Majeure), delete the first sentence of the section and replace it with the following:

“Neither of us shall be responsible for failure or delay of performance if caused by: an act of war, hostility, or sabotage; act of God, pandemic, electrical, internet, or telecommunication outage that is not caused by the obligated party; government restrictions (including the denial or cancellation of any export or other license); other event outside the reasonable control of the obligated party.”

Other than the modifications above, the terms and conditions of the agreement remain unchanged and in full force and effect.

The effective date of this Amendment Two is February 29, 2012.

OUTSIDE IN

PREPAID ROYALTY ADDENDUM

to the

EMBEDDED SOFTWARE LICENSE DISTRIBUTION AGREEMENT

Between

GUIDANCE SOFTWARE, INC.

and

ORACLE AMERICA, INC.

This Outside In Prepaid Royalty Addendum (the “Addendum”) is between Oracle America, Inc. (“Oracle”) and Guidance Software, Inc. (“you”) and shall be governed by and incorporated into the terms of the Oracle PartnerNetwork Embedded Software License Distribution Agreement (US-OPN-EMBD-12147270-28-Nov-08) between Oracle and you dated November 28, 2008 (the “agreement”). For clarification purposes, the agreement, not the Addendum, is dated November 28, 2008. The rights and obligations defined herein are in addition to all terms in the agreement. Definitions used in the agreement shall have the same meaning under this Addendum, unless expressly stated otherwise. If there is a direct conflict between a term of this Addendum and a term of the agreement with respect to the subject matter of this Addendum, the term of this Addendum shall prevail.

Any distribution rights granted will be limited to the application package(s) set forth in section 7 of this Addendum (the “application package”) and may not be combined with any additional functionality or additional application programs. You may only distribute the embedded programs as part of the application package(s) specified in section 7 of this Addendum and defined in an Outside In Application Package Registration Form.

1.             Agreement Definitions

Amend Section A of the agreement, Agreement Definitions, as follows:

For the purposes of this Addendum, the term “Distribution Term” shall mean a period of 4 years from the effective date hereof or such earlier period as set forth below.

Notwithstanding anything to the contrary in the agreement, for the purposes of this Addendum, the term “programs” refers to the versions of the software products owned or distributed by Oracle and set forth on the Outside In Application Package Registration Form which you order from Oracle for development, trial, or demonstration purposes as provided in the agreement, and for distribution to an end user embedded with the application package as provided in this Addendum, including program documentation and any program updates acquired through technical support. The term “programs” shall not include any Oracle programs which are not included on the Outside In Application Package Registration Form.

Notwithstanding anything to the contrary in the agreement, for the purposes of this Addendum, the term “embedded” shall refer to the requirements and restrictions defined in the Outside In Application Package Registration Form with which the application package must comply.

2.             Prepaid Licenses

Notwithstanding anything to the contrary in and pursuant to the terms of this Addendum and the agreement, in consideration for your payment of $1,500,000 (“Prepaid Royalty”) you may distribute licenses of the embedded programs defined in the Outside In Application Package Registration Form to end users with the application package (“Prepaid Licenses) during the Distribution Term. Notwithstanding anything to the contrary in the agreement, the license fee payable for each Prepaid License shall be in accordance with the license fee table below:

For the first year of the Distribution Term, the fee for end user technical support for the Prepaid Licenses (the “Initial Annual Support Fee”) shall be $165,000.

You agree to submit to Oracle a quarterly report for Prepaid Licenses distributed to end users in accordance with section 5 below. During the Distribution Term, the license fee due under such quarterly report shall be deducted from the amount of the Prepaid Royalty until such time as the Prepaid Royalty is reduced to zero. When the Prepaid Royalty is reduced to zero then further distribution of the embedded programs and services and the related fees due to Oracle shall be in accordance with section 3 below.

Technical support for the Prepaid Licenses shall be renewed annually for the duration of the Distribution Term. Notwithstanding anything to the contrary in the agreement, for each renewal year in the Distribution Term the fee for such renewal will not increase by more than 4% over the prior year’s fees. The Initial Annual Support Fee set forth above does not include any fees due and payable to Oracle for technical support for any programs distributed by you prior to the effective date of this Addendum, any fees due and payable to Oracle for technical support for any programs distributed by you under a prior distribution agreement with Oracle, any end user technical support fees due for Incremental Licenses set forth in section 3 below, or any fees due and payable to Oracle for technical support for any programs distributed by you under the agreement which are not included in this Addendum.

The Prepaid Royalty and Initial Annual Support Fee payable to Oracle under this section 2 of this Addendum are due within 30 days of the effective date of this Addendum. This payment obligation is non-cancelable, and the sum paid is nonrefundable, is not subject to set-off for any reason, and is not subject to the completion or occurrence of any event after the signature date of this Addendum.

You may provide technical support to end users for embedded programs that you distribute with the application package only for those programs for which you have previously acquired a supported development license. Your distribution of the embedded programs is subject to the terms of the agreement and this Addendum. In the event that you do not (a) distribute the embedded programs and Prepaid Licenses in accordance with this Addendum and the agreement or (b) pay the annual technical support fees for the Prepaid Licenses due for any renewal year under this Addendum for the duration of the Distribution Term, then the Distribution Term and your right to distribute the embedded programs and the Prepaid Licenses under this Addendum and to provide technical support for the embedded programs and the Prepaid Licenses shall immediately terminate.

3.             Incremental Licenses

When the amount of the Prepaid Royalty has been reduced to zero then, for the remainder of the Distribution Term, you may continue to distribute the embedded programs with the application package to end users pursuant to section B of the agreement, Distribution Rights (hereinafter such additional distributed programs shall be referred to as “Incremental Licenses”) provided that you (a) pay Oracle the applicable license fees and annual end user technical support fees for any such Incremental Licenses in accordance with the terms of this section 3 and (b) submit quarterly reports for the Incremental Licenses and services for such Incremental Licenses in accordance with section 5 below.

Notwithstanding anything to the contrary in section H of the agreement, Fees and Taxes, for the Distribution Term, fees payable to Oracle for the distribution of Incremental Licenses (“Incremental License Fees”) shall be in accordance with the table below:

In addition, with regard to fees for technical support you provide to end users for the Incremental Licenses, you agree to pay Oracle an annual end user technical support fee equal to 11% of the Incremental License Fees for the first year that end users contract for or obtain technical support from you. Thereafter, annual end user technical support fees for the Incremental Licenses shall be in accordance with Oracle’s then-current standard technical support policies.

4.             Technical Support Following the End of the Distribution Term

Following the end of the Distribution Term, you may continue to renew end user technical support for the embedded programs and provide technical support to your end users of such programs provided that you continuously maintain technical support for the development licenses, you pay all applicable fees set forth in this agreement, and you maintain your membership in the Oracle PartnerNetwork. Following the end of the Distribution Term, renewal of annual end user technical support services shall be provided in accordance with Oracle’s then-current technical support policies and the terms of the agreement and this Addendum. Subject to the terms of the agreement, the renewal fee for the first year for end user technical support for the embedded programs shall be equal to the total technical support fee paid for the last year of the Distribution Term plus Oracle’s then current technical support annual percentage increase which shall not exceed 4%. After the first year following the end of the Distribution Term, renewal of annual end user technical support services for the embedded programs shall be provided in accordance with Oracle’s then-current technical support policies and the terms of the agreement.

Renewal fees for end user technical support shall be invoiced by Oracle annually in advance. Fees for end user technical support shall be due and payable in advance thirty (30) days from date of invoice. Your payment obligation for end user technical support fees is non-cancelable, and the sum paid is nonrefundable, is not subject to set-off for any reason, and is not subject to the completion or occurrence of any event after the signature date of this Addendum.

5.             Reporting

You shall submit quarterly reports for the embedded programs that you distribute pursuant to this Addendum in accordance with Section F of the agreement, Reporting. Notwithstanding anything to the contrary in the agreement, in each quarterly report that you submit pursuant to this section 5, you shall provide the following information: the name of the programs licensed; the name, including date or version, of the applicable end user license agreement; the name, including the date or version, of your agreement with Oracle under which the programs are being distributed; the applicable license metrics, quantity, and term designation; the date of the end user’s order; and the total license and end user technical support fees payable to the Oracle group company for that quarter. Notwithstanding the above, where an end user prohibits you from providing such end users’ name, address, and email address information to Oracle pursuant to a valid agreement between you and such end user, you may provide a unique identifier for each

end user in lieu of the data elements required in the Partner Ordering Policy of end user name, address and email address. Such unique identifier shall include not less than the state and zip code (or country and postal code, if the end user is not located in the United States) where the end user resides. You agree to maintain a listing of such unique identifiers and the corresponding end user name, addresses, and email addresses to disclose to Oracle as part of an audit pursuant to Section V of this agreement and/or upon Oracle’s request in the event of an alleged breach of the end user license agreement by the end user. Additionally, for any specified unique identifier, you agree that at Oracle’s request you will confirm whether or not such unique identifier represents any company or commercial entity listed on a customer list provided by Oracle.

6.             Term

The term of this Addendum shall commence on the effective date below and shall be valid for the Distribution Term unless terminated earlier as provided herein or in the agreement. Upon the end of the Distribution Term, your right to distribute the embedded programs and the Prepaid Licenses under this Addendum and, except as set forth in section 4 above, to provide end user technical support for the embedded programs and the Prepaid Licenses, shall cease. You will not be entitled to receive any refund or credit for any amount of the Prepaid Royalty that remains unused at the end of the Distribution Term. Notwithstanding anything to the contrary in the agreement, this Addendum may not be extended or renewed, unless the parties agree in writing. You understand and agree that you may not continue to distribute the programs with the application program defined herein after the expiration or termination of the Distribution Term unless and until new terms and pricing have been agreed in writing by both parties. For the purposes governing this Addendum only, in the event that the term of the agreement expires before the term of this Addendum then the term of the agreement shall be extended for the remainder of the term of the Addendum only. Distributions outside of the terms of this Addendum would be subject to execution of a new Embedded Software License Distribution Agreement.

7.             Application Packages

Your distribution of the embedded programs under this Addendum applies only to the application packages identified below and described in the relevant Outside In Application Package Registration Form attached to this Addendum.

8.             Ownership and Restrictions

Notwithstanding anything to the contrary in this agreement, and in addition to the restrictions in section G of the agreement, you may not:

Oracle reserves any rights not expressly granted to you under this agreement

9.             Supported File Format List

Notwithstanding anything to the contrary in the agreement, you may, at your option, reproduce and distribute all or a portion of the supported file format list found in the program documentation, provided, however, that under no circumstances shall you reproduce or distribute any other portion of the program documentation, including without limitation, any portion of the program documentation that exposes the program APIs.

10.      Warranties, Disclaimers and Exclusive Remedies

For the purposes of this Addendum only, the following shall be inserted after the second paragraph in section I Warranties, Disclaimers and Exclusive Remedies:

“THE PARTIES ACKNOWLEDGE AND AGREE THAT FILE RENDERING AND CONVERSION ARE AFFECTED BY FACTORS INCLUDING, BUT NOT LIMITED TO, THE AVAILABLE FONTS AND DISPLAY SIZE ON THE TARGET MACHINE, AND THE CURRENT TAG SET AND CAPABILITIES OF SUPPORTED MARKUP LANGUAGES. AS SUCH, ONLY THOSE ELEMENTS OF THE SOURCE FILE THAT CAN BE REASONABLY REPRESENTED IN THE SELECTED FORMAT WILL BE DISPLAYED IN THE RENDERED OR CONVERTED FILE. FOR EXAMPLE, THE CONVERSION OF SPREADSHEETS TO IMAGES IS LIMITED BY THE STRUCTURE OF SPREADSHEET FORMATS WHICH IS NOT CONDUCIVE TO THE STRICT FORMATTING IMPOSED BY PAGE LAYOUT.”

11.      Internet Hosting

Notwithstanding the terms of the agreement, you shall have the right to license the EnCase Enterprise Examiner and Encase Concurrent Connection application package(s) (“EnCase applications packages”), as defined in the application package registration form(s) specified in section 7 above to end users so that such end users may use the Encase application packages to provide internet hosting services to their customers (“Hosted Application Package”). You may allow your end users to provide access to the Hosted Application Packages for their customers’ business operations and/or to provide services to third parties using the Hosted Application Packages, provided that all such use shall be subject to the terms of your end user license agreement with your end users that meets the requirements of the section G of the agreement, License Agreement. You shall prohibit your end users from reselling or assigning their licenses of the Hosted Application Packages to their customers and from providing access to their customers to any Oracle programs. You agree to require your end users to be financially responsible to Oracle for all damages or losses resulting from the end users’ and their customers’ breach of these terms. Your end users’ customers, including human and non-human users, accessing the Hosted Application packages and your end users’ computers running the Hosted Application Packages shall be included in determining the quantity of program licenses deployed by your end users. Notwithstanding anything to the contrary in this agreement, you and your affiliated entities may not be considered end users under this paragraph (i.e., you and your affiliated entities cannot use the application packages embedded with the programs to provide internet hosting services).

12.      Delivery

Oracle has no delivery obligation under this Addendum. You acknowledge that Oracle has previously delivered to your location, 1 copy of the software media and 1 set of program documentation (in the form generally available) for each program in the application package. In entering into payment obligations under this Addendum, you agree and acknowledge that you and the end user have not relied on the future availability of any program or updates.

[signature page follows]

Other than the modifications above, the terms and conditions of the agreement remain unchanged and in full force and effect. The effective date of this Addendum is February 29, 2012 [to be completed by Oracle].

OUTSIDE IN APPLICATION PACKAGE REGISTRATION FORM

This Outside In Application Package Registration Form must be completed in its entirety. Any distribution rights granted will be limited to the Application Package detailed on this form and may not be combined with any additional functionality or additional application programs. A separate Outside In Application Package Registration Form is required for each application package that is functionally unique.

Once this Outside In Application Package Registration Form is complete and signed by you and Oracle, it will be attached to the executed Embedded Software License Distribution Agreement or addendum thereto.

PUBLIC SECTOR ADDENDUM

to the

EMBEDDED SOFTWARE LICENSE DISTRIBUTION AGREEMENT

between

GUIDANCE SOFTWARE, INC.

and

ORACLE AMERICA, INC.

This Public Sector Addendum (the “addendum”) is between Oracle America, Inc. (“Oracle”) and Guidance Software, Inc. (“you”) and shall be governed by and incorporated into the terms of the Oracle PartnerNetwork Embedded Software License Distribution Agreement (US-OPN-EMBD-12147270-28-NOV-08) between Oracle and you dated November 28, 2008 (the “agreement”). The rights and obligations defined herein are in addition to all terms in the agreement. Definitions used in the agreement shall have the same meaning under this addendum, unless expressly stated otherwise. If there is a direct conflict between a term of this addendum and a term of the agreement with respect to the subject matter of this addendum, the term of this addendum shall prevail.

1.             Agreement Definitions

For the purposes of this addendum, the term “public sector end user” refers to an end user that is (a) a government, legislature or decision making body, instrumentality, department, or agency at any level (national, local, municipal or otherwise); entities managed, controlled or majority owned by government interests; public organizations or foundations of any kind (including political parties, political organizations, or political candidates); and any public international organization, such as, but not limited to, the International Red Cross, United Nations, or the World Bank; and (b) licensed to use the application program with the embedded programs for its own internal business operations subject to the terms of an end user license agreement as further provided for in the agreement.

2.             Distribution Rights

Notwithstanding anything to the contrary in the agreement, Oracle grants you a nonexclusive, nontransferable right to distribute programs and/or services to public sector end users subject to the terms of the agreement.

3.             Order Terms

Notwithstanding anything to the contrary in section F of the agreement, Reporting, upon request from Oracle, you agree to submit to Oracle a copy of the end user license agreement related to each order for a public sector end user and any ordering documents, purchase agreements and other documents between you and the public sector end user that together with the end user license agreement form the complete end user contract related to the order.

4.             U.S. Government End Users

Oracle programs, including documentation, delivered to U.S. Government end users are “commercial computer software” pursuant to the applicable Federal Acquisition Regulation (“FAR”) and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including documentation, shall be subject to the license and license restrictions set forth in this agreement, and, to the extent applicable, the additional rights set forth in FAR 52.227-19, Commercial Computer Software – Restricted Rights (June 1987).

5.             Term and End of Agreement

The term of this addendum shall commence on its effective date below and shall co-terminate with the agreement unless terminated earlier as provided in the agreement. Notwithstanding anything to the contrary in the agreement, this addendum may be terminated by either party at any time by providing thirty (30) days prior written notice to the other party.

Other than the modifications above, the terms and conditions of the agreement remain unchanged and in full force and effect. The effective date of this addendum is February 29, 2012. [to be completed by Oracle]