GUIDANCE SOFTWARE, INC. AMENDED ANDRESTATED EXECUTIVE RETENTION AND SEVERANCE PLAN

Exhibit 10.3

GUIDANCE SOFTWARE, INC.

AMENDED AND RESTATED

EXECUTIVE RETENTION AND SEVERANCE PLAN

SECTION 1. PURPOSE. The purpose of the Guidance Software, Inc. Amended and Restated Executive Retention and Severance Plan (the “Plan”) is to promote the interests of Guidance Software, Inc. (the “Company”) and its stockholders by attracting and retaining exceptional executive personnel and other key employees of the Company. The Board of Directors of the Company (the “Board”) recognizes that the possibility or pending occurrence of a Change of Control could lead to uncertainty regarding the consequences of such an event and could adversely affect the Company’s ability to attract, retain and motivate its officers and other key employees. The Board has therefore determined that it is in the best interests of the Company and its stockholders to provide for the continued dedication of its officers and key employees notwithstanding the possibility or occurrence of a Change of Control by establishing this Plan to provide designated officers and key employees with enhanced financial security in the event of a Change of Control. The Plan is designed to provide its Participants with specified compensation and benefits in the event of a Change of Control or termination of employment under circumstances specified herein upon or following a Change of Control. Effective as of December 19, 2008, this Plan amends and restates in its entirety the Guidance Software, Inc. Executive Retention and Severance Plan, dated April 20, 2005.

SECTION 2. DEFINITIONS. As used in the Plan, the following terms shall have the meanings set forth below:

A. “Cause” means (i) Participant’s failure to render services to the Company or its subsidiaries in accordance with Participant’s assigned duties and responsibilities, and such failure of performance continues for a period of more than fifteen days after notice thereof has been provided to Participant by the Company (other than any such failure resulting from Participant’s disability); (ii) any action or omission by Participant involving willful misconduct or gross negligence relating to Participant’s duties and responsibilities to the Company or its affiliates, including without limitation, disloyalty, dishonesty or breach of fiduciary duty; (iii) Participant’s commission of (as determined by the Company) or indictment for a crime, either in connection with the performance of Participant’s obligations to the Company or its affiliates or which otherwise shall adversely affect Participant’s ability to perform such obligations or which shall adversely affect the business activities, reputation, goodwill or image of the Company or its affiliates; (iv) Participant’s breach of any material obligation Participant has under any written agreement with the Company or its affiliates or which has been delegated to Participant by the Company which, if capable of cure, is not cured within five days from receipt of notice from the Company; or (v) any act of fraud, embezzlement, theft or misappropriation from the Company or its affiliates by Participant.

B. “Change of Control” means a Corporate Transaction other than a merger, consolidation or other capital reorganization in which the holders of more than fifty percent (50%) of the shares of capital stock of the Company outstanding immediately prior to such transaction continue to hold (either by the voting securities remaining outstanding or by being converted into voting securities of the surviving entity) more than fifty percent (50%) of the total voting power represented by the voting securities of the Company, or such surviving entity, outstanding immediately after such transaction.

C. “Constructive Termination” means Participant’s voluntary termination, upon thirty (30) days prior written notice to the Company, within sixty (60) days after the occurrence of any of the following events without the Participant’s prior written consent: (1) a reduction by the Company of the Participant’s base compensation by greater than five percent (5%); (2) the Company (or, as applicable, the successor or surviving entity) following a Change of Control does not continue Participant’s employment in a senior position for the business that constitutes the Company’s operations immediately prior to the Change of Control with the same or greater authority, duties, and responsibilities as those held by the Participant immediately prior to the Change of Control; or (3) Participant is required to report for work in person on a regular and daily basis at a facility or location more than thirty-five (35) miles from Participant’s current office location.

D. “Corporate Transaction” means the Company becoming majority owned by another corporation or entity, or a sale of all or substantially all of the Company’s stock or assets, or a merger, consolidation or other capital reorganization of the Company with or into another corporation.

E. “Participant” means any employee of the Company selected by the Board to be eligible to receive benefits under the Plan (and to the extent applicable, any heirs or legal representatives thereof).

F. “Participation Agreement” means an agreement to participate in the Plan substantially in the form attached hereto as Exhibit A or in such other form as the Board may approve from time to time; provided, however, that, after a Participation Agreement has been entered into between a Participant and the Company, it may be modified only by a supplemental written agreement executed by both Participant and the Company.

SECTION 3. ELIGIBILITY. The Board shall designate those officers and key employees who shall be eligible to become Participants in the Plan.

SECTION 4. CHANGE OF CONTROL. In the event of a Change of Control, the following provisions will apply:

A. Subject to Section 4.D. below, if, during the two (2)-year period immediately following the closing of a Change of Control, Participant incurs a “separation from service” from the Company (within the meaning of Section 409A(a)(2)(A)(i) of the Internal Revenue Code of 1986, as amended (the “Code”), and Treasury Regulation Section 1.409A-l(h)) (a “Separation from Service”) by reason of a termination of Participant’s employment by the Company without Cause, or by Participant as the result of a Constructive Termination, then:

1. The Company shall pay Participant a lump sum, one-time payment equal to twice Participant’s annual base salary in effect on the date of Participant’s Separation from Service, plus an amount equal to any tax imposed on such payment under Section 4999 of the Code (but not grossed up further with respect to any such tax imposed on any other payment to Participant or any tax imposed on the tax gross-up payment itself) (such aggregate amount, the “Change of Control Payment”), payable within fifteen (15) days after the date of Participant’s Separation from Service (with the exact payment date to be determined by the Company in its discretion);

2

2. For a period of twenty-four (24) months immediately following the date of Participant’s Separation from Service (the “Continuation Period”), the Company shall provide medical insurance, dental insurance and vision insurance (collectively, the “Health Insurance Benefits”) to Participant at the same premium cost to Participant and at the same coverage level as in effect immediately preceding the date of Participant’s termination of employment. If such Health Insurance Benefits are to be provided through third-party insurance maintained by the Company under the Company’s benefit plans in a manner that causes such Health Insurance Benefits to be exempt from the application of Section 409A of the Code under Treasury Regulation Section 1 .409A- 1 (a)(5), the Company shall pay or reimburse the Company- subsidized portion of the insurance premiums in accordance with the Company’s normal payment practices, provided, that if, any plan pursuant to which such Health Insurance Benefits are provided is not, or ceases prior to the expiration of the Continuation Period to be, exempt from the application of Section 409A of the Code under Treasury Regulation Section l.409A- 1 (a)(5), then an amount equal to the Company-subsidized portion of each remaining premium payment or reimbursement shall thereafter be paid to Participant as currently taxable compensation in substantially equal monthly installments over the remainder of the Continuation Period.

3. For the Continuation Period, the Company shall provide life insurance and disability insurance coverage to Participant that is reasonably similar to that provided to Participant immediately prior to Participant’s termination of employment, provided that such coverage shall be provided at the same premium cost to Participant and on substantially the same terms and conditions as in effect immediately preceding the date of Participant’s termination of employment. To the greatest extent applicable, such coverage shall be provided in a manner that satisfies the exemption from Section 409A of the Code under Treasury Regulation Section l.409A-1(a)(5). To the extent that such coverage does not satisfy such exemption, the Company shall provide such coverage by making direct payment, in accordance with the Company’s standard payment practices for such insurance, to the insurer of the cost of Participant’s life insurance and disability insurance premiums applicable to such continued coverage; provided, however, that the Company shall not be obligated to make such direct payments to the insurer or provide such coverage unless the Participant remits to the Company on a monthly basis an amount equal to the Participant’s monthly premium cost for such coverage.

B. If Participant dies at any time during the three (3) month period prior to the date on which a Change of Control occurs (the “Change of Control Date”), or the three (3) month period after the Change of Control Date, the Company shall make the Change of Control Payment to the estate of Participant as follows:

(i) if Participant’s death occurs prior to the Change of Control Date, such payment shall be made within fifteen (15) days after the earlier to occur of (i) the date which is three months after the date of Participant’s death, or (ii) the Change of Control Date, but only if such Change of Control constitutes a “change in control event” (within the meaning of Section 409A(a)(2)(A)(v) of the Code, and Treasury Regulation Section 1 .409A-3(i)(5)) (with the exact payment date to be determined by the Company in its discretion); and

3

(ii) if Participant’s death occurs on or after the Change of Control Date, such payment shall be made within fifteen (15) days after the date of Participant’s death (with the exact payment date to be determined by the Company in its discretion).

C. Subject to Section 4.D. below, if Participant incurs a Separation from Service by reason of Participant’s resignation of his employment for any reason during the period commencing on the date that is six (6) months after the Change of Control Date and ending on the date that is twelve (12) months after the Change of Control Date, the Company shall make the Change of Control Payment to Participant within fifteen (15) days after the date of Participant’s Separation from Service (with the exact payment date to be determined by the Company in its discretion) (and, for the avoidance of doubt, Participant shall not also be entitled to an additional Change in Control Payment under Section 4.A. 1 above).

B. Notwithstanding anything to the contrary in the Plan, no compensation or benefits, including without limitation any severance payments or benefits payable under this Section 4, shall be paid to Participant during the 6-month period following Participant’s Separation from Service if the Company determines that paying such amounts at the time or times indicated in the Plan would be a prohibited distribution under Section 409A(a)(2)(B)(i) of the Code. If the payment of any such amounts is delayed as a result of the previous sentence, then on the first business day following the end of such 6-month period (or such earlier date upon which such amount can be paid under Section 409A of the Code without resulting in a prohibited distribution, including as a result of Participant’s death), the Company shall pay Participant a lump-sum amount equal to the cumulative amount that would have otherwise been payable to Participant during such period.

E. The Company will inform the successor (whether direct or indirect, by purchase, merger, consolidation or otherwise) to the Company prior to the closing of the Change of Control of the provisions of this Section 4, and will require such successor to assume the Plan as a condition to a closing of the Change of Control. For purposes of the Plan, “Company” shall be deemed to mean the Company as defined in Section 1 and any such successor, including any surviving entity thereof, that assumes the Plan by operation of law or otherwise.

SECTION 5. TERMINATION AND AMENDMENT OF THE PLAN. The Plan and/or any Participation Agreement executed by a Participant may not be terminated with respect to such Participant without the written consent of Participant. The Plan and/or any Participation Agreement executed by a Participant may be modified, amended or superseded with respect to such Participant only by a supplemental written agreement between Participant and the Company.

4

SECTION 6. AGREEMENT. By executing a Participation Agreement, Participant acknowledges that Participant has received a copy of this Plan and has read, understands and is familiar with the terms and provisions of this Plan. This Plan shall constitute an agreement between the Company and Participant executing a Participation Agreement.

SECTION 7. NO DUPLICATION OF BENEFITS. The payments and benefits provided under this Plan are in lieu of and not in addition to any severance benefits provided under the terms of any employment or other agreement between a Participant and the Company, and in no event shall any Participant be entitled to any payment or benefit under the Plan to the extent that such payment or benefit would result in a duplication of a payment or benefit to which such Participant is entitled under such employment or other agreement.

SECTION 8. CODE SECTION 409A.

A. To the extent applicable, the Plan shall be interpreted and applied consistent and in accordance with Section 409A of the Code and Department of Treasury regulations and other interpretive guidance issued thereunder. Notwithstanding any provision of the Plan to the contrary, if the Company determines that any compensation or benefits payable under the Plan may not be either exempt from or compliant with Section 409A of the Code and related Department of Treasury guidance, the Company may in its sole discretion adopt such amendments to the Plan or adopt other policies and procedures (including amendments, policies and procedures with retroactive effect), or take any other actions, that the Company determines are necessary or appropriate to (i) exempt the compensation and benefits payable under the Plan from Section 409A of the Code and/or preserve the intended tax treatment of such compensation and benefits, or (ii) comply with the requirements of Section 409A of the Code and related Department of Treasury guidance; provided, however, that this paragraph shall not create an obligation on the part of the Company to adopt any such amendment, policy or procedure or take any such other action.

B. To the extent permitted under Section 409A of the Code, any separate payment or benefit under the Plan or otherwise shall not be deemed “nonqualified deferred compensation” subject to Section 409A of the Code (and Section 4.D. above) to the extent provided in the exceptions in Treasury Regulation Section 1 .409A- 1 (b)(4), Section 1 .409A- 1 (b)(9) or any other applicable exception or provision of Section 409A of the Code.

C. To the extent that any payments or reimbursements provided to any Participant under the Plan are deemed to constitute compensation to which Treasury Regulation Section l.409A-3(i)(l)(iv) would apply, such amounts shall be paid or reimbursed to Participant reasonably promptly, but not later than December 31 of the year following the year in which the expense was incurred. The amount of any such payments eligible for reimbursement in one year shall not affect the payments or expenses that are eligible for payment or reimbursement in any other taxable year, and Participant’s right to such payments or reimbursement shall not be subject to liquidation or exchange for any other benefit.

5

IN WITNESS WHEREOF, the undersigned Secretary of the Company certifies that the foregoing Plan was duly adopted by the Board on December 19, 2008.

6

Exhibit A

FORM OF AGREEMENT TO PARTICIPATE IN THE

GUIDANCE SOFTWARE, INC.

AMENDED AND RESTATED EXECUTIVE RETENTION AND SEVERANCE PLAN

Agreement to Participate in the Guidance Software, Inc. Amended and Restated Executive Retention and Severance Plan

In consideration of the benefits provided by the Guidance Software, Inc. Amended and Restated Executive Retention and Severance Plan (the “Plan”), the undersigned employee of Guidance Software, Inc. (the “Company”) and the Company agree that, as of the date written below, the undersigned shall become a Participant in the Plan and shall be fully bound by and subject to all of its provisions. All references to a “Participant” in the Plan shall be deemed to refer to the undersigned.

The undersigned employee acknowledges that the Plan confers significant legal rights and may also constitute a waiver of rights under other agreements with the Company; that the Company has encouraged the undersigned to consult with the undersigned’s personal legal and financial advisers; and that the undersigned has had adequate time to consult with the undersigned’s advisers before executing this agreement.

The undersigned employee acknowledges that he or she has received a copy of the Plan and has read, understands and is familiar with the terms and provisions of the Plan. The undersigned employee further acknowledges that, except as otherwise established in an employment agreement between the Company and the undersigned, if any, the employment relationship between the undersigned and the Company is an “at-will” relationship.