GUIDANCE SOFTWARE, INC. FIRST AMENDED AND RESTATED2004 EQUITY INCENTIVE PLAN RESTRICTED STOCK AGREEMENT

Exhibit 10.21

GUIDANCE SOFTWARE, INC.

FIRST AMENDED AND RESTATED 2004 EQUITY INCENTIVE PLAN

RESTRICTED STOCK AGREEMENT

Guidance Software, Inc., a Delaware corporation (the “Company”), pursuant to its First Amended and Restated 2004 Equity Incentive Plan, as amended from time to time (the “Plan”), hereby grants to the individual listed below (“Holder”), the number of shares of the Company’s common stock, par value $0.001 per share, set forth below (the “Shares”). This Restricted Stock Award is subject to all of the terms and conditions as set forth in this Restricted Stock Agreement (the “Agreement”) (including without limitation the Restrictions on the Shares set forth in the Agreement) and the Plan, each of which are incorporated herein by reference. Unless otherwise defined herein, the terms defined in the Plan shall have the same defined meanings in this Agreement.

ARTICLE I.

GENERAL

1.1 Definitions. All capitalized terms used in this Agreement without definition shall have the meanings ascribed in the Plan.

1

1.2 Incorporation of Terms of Plan. The Award (as defined below) is subject to the terms and conditions of the Plan which are incorporated herein by reference. In the event of any inconsistency between the Plan and this Agreement, the terms of the Plan shall control.

ARTICLE II.

AWARD OF RESTRICTED STOCK

2.1 Award of Restricted Stock.

(a) Award. In consideration of the Holder’s agreement to remain in the service or employ of the Company or one of its Subsidiaries, and for other good and valuable consideration, the Company issues to the Holder the Award described in this Agreement (the “Award”). The number of shares of Restricted Stock (the “Shares”) subject to the Award is set forth in the Notice of Restricted Stock Award above. The Holder is a Service Provider of the Company.

(b) Book Entry Form. At the sole discretion of the Administrator, the Shares will be issued in either (i) uncertificated form, with the Shares recorded in the name of the Holder in the books and records of the Company’s transfer agent with appropriate notations to the extent that the Shares remain subject to the Restrictions (as defined below); or (ii) certificate form pursuant to the terms of Sections 2.1(c) and (d).

(c) Legend. Certificates representing Shares issued pursuant to this Agreement shall, until all Restrictions on transfer imposed pursuant to this Agreement lapse or shall have been removed and new certificates are issued, bear the following legend (or such other legend as shall be determined by the Administrator):

“THE SECURITIES REPRESENTED BY THIS CERTIFICATE ARE SUBJECT TO CERTAIN VESTING REQUIREMENTS AND MAY BE SUBJECT TO FORFEITURE UNDER THE TERMS OF A RESTRICTED STOCK AWARD AGREEMENT BY AND BETWEEN GUIDANCE SOFTWARE, INC. AND THE REGISTERED OWNER OF SUCH SHARES, AND SUCH SHARES MAY NOT BE, DIRECTLY OR INDIRECTLY, OFFERED, TRANSFERRED, SOLD, ASSIGNED, PLEDGED, HYPOTHECATED OR OTHERWISE DISPOSED OF UNDER ANY CIRCUMSTANCES, EXCEPT PURSUANT TO THE PROVISIONS OF SUCH AGREEMENT.”

(d) Escrow. The Secretary of the Company or such other escrow holder as the Administrator may appoint may retain physical custody of any certificates representing the Shares until all of the Restrictions on transfer imposed pursuant to this Agreement lapse or shall have been removed. If an escrow holder is so appointed, the Holder shall not retain physical custody of any certificates representing Shares issued to the Holder that are unvested and subject to Restrictions.

2

2.2 Restrictions.

(a) Forfeiture of Shares. In the event that the Holder ceases to be a Service Provider for any reason, then, immediately upon such termination, the Holder shall automatically and without further action by the Holder, the Company or any other party forfeit any and all Shares then subject to the Restrictions, and the Holder shall have no further right or interest in such Shares. Upon such forfeiture, such Shares shall, automatically and without further action by the Holder, the Company or any other party, be cancelled and return to the status of authorized but unissued shares of the Company’s common stock. For purposes of this Agreement, “Restrictions” shall mean the restrictions on sale or other transfer set forth in Section 3.1 and the exposure to forfeiture set forth in this Section 2.2(a).

(b) Vesting and Lapse of Restrictions. Subject to Section 2.2(a), the Award shall vest and the Restrictions shall lapse in accordance with the vesting schedule set forth in the Notice of Restricted Stock Award above, provided, however, that to the extent permitted by applicable law, the Administrator may, in its sole discretion, suspend the vesting and lapsing of Restrictions applicable to the Award during all or any part of any leave of absence from employment taken by the Holder.

(c) Accelerated Vesting. Subject to Section 2.2(a), in the event that an Acquisition occurs, then, immediately prior thereto, the Award shall vest and the Restrictions shall lapse with respect to 100% of the Shares subject thereto, provided that the Holder continues to be a Service Provider until the Acquisition

(d) Tax Withholding; Conditions to Issuance of Certificates. Notwithstanding any other provision of this Agreement (including without limitation Section 2.1(b)):

(i) No Shares shall be recorded in the name of the Holder in the books and records of the Company’s transfer agent and no new certificate shall be delivered to the Holder or his legal representative unless and until the Holder or his legal representative shall have paid to the Company the full amount of all federal and state withholding or other taxes applicable to the taxable income of Holder resulting from the grant of Shares or the lapse or removal of the Restrictions. The Administrator may in its discretion and in satisfaction of the foregoing requirement allow the Holder to elect to have the Company withhold shares of the Company’s common stock otherwise issuable under the Award (or allow the return of shares of the Company’s common stock) having a Fair Market Value equal to the sums required to be withheld. Notwithstanding any other provision of the Plan or this Agreement, the number of shares of the Company’s common stock which may be withheld with respect to the issuance, vesting or payment of the Shares in order to satisfy the Holder’s federal and state income and payroll tax liabilities with respect to the issuance, vesting or payment of the Shares shall be limited to the number of shares of the Company’s common stock which have a Fair Market Value on the date of withholding equal to the aggregate amount of such liabilities based on the minimum statutory withholding rates for federal and state tax income and payroll tax purposes that are applicable to such supplemental taxable income.

(ii) The Company shall not be required to record any Shares in the name of the Holder in the books and records of the Company’s transfer agent or issue or deliver any certificate or certificates for any Shares prior to the fulfillment of all of the following conditions: (A) the admission of the Shares to listing on all stock exchanges on which the

3

Company’s common stock is then listed, (B) the completion of any registration or other qualification of the Shares under any state or federal law or under rulings or regulations of the Securities and Exchange Commission or other governmental regulatory body, which the Administrator shall, in its sole and absolute discretion, deem necessary and advisable, (C) the obtaining of any approval or other clearance from any state or federal governmental agency that the Administrator shall, in its absolute discretion, determine to be necessary or advisable and (D) the lapse of any such reasonable period of time following the date the Restrictions lapse as the Administrator may from time to time establish for reasons of administrative convenience.

ARTICLE III.

OTHER PROVISIONS

3.1 Restricted Stock Not Transferable. No Shares that are subject to the Restrictions or any interest or right therein or part thereof shall be liable for the debts, contracts or engagements of the Holder or his successors in interest or shall be subject to disposition by transfer, alienation, anticipation, pledge, encumbrance, assignment or any other means whether such disposition be voluntary or involuntary or by operation of law by judgment, levy, attachment, garnishment or any other legal or equitable proceedings (including bankruptcy), and any attempted disposition thereof shall be null and void and of no effect.

3.2 Rights as Stockholder. Except as otherwise provided herein, upon the Grant Date the Holder shall have all the rights of a stockholder with respect to the Shares, subject to the Restrictions contained herein, including the right to vote the Shares and the right to receive any cash or stock dividends paid to or made with respect to the Shares.

3.3 Not a Contract of Employment. Nothing in this Agreement or in the Plan shall confer upon the Holder any right to continue to serve as an employee or other service provider of the Company or any of its Subsidiaries.

3.4 Governing Law. The laws of the State of California shall govern the interpretation, validity, administration, enforcement and performance of the terms of this Agreement regardless of the law that might be applied under principles of conflicts of laws.

3.5 Conformity to Securities Laws. The Holder acknowledges that the Plan and this Agreement are intended to conform to the extent necessary with all provisions of the Securities Act and the Exchange Act, and any and all regulations and rules promulgated thereunder by the Securities and Exchange Commission, including without limitation Rule 16b-3 under the Exchange Act. Notwithstanding anything herein to the contrary, the Plan shall be administered, and this Award is granted, only in such a manner as to conform to such laws, rules and regulations. To the extent permitted by applicable law, the Plan and this Agreement shall be deemed amended to the extent necessary to conform to such laws, rules and regulations.

3.6 Amendment, Suspension and Termination. To the extent permitted by the Plan, this Agreement may be wholly or partially amended or otherwise modified, suspended or terminated at any time or from time to time by the Administrator or the Board, provided, that, except as may otherwise be provided by the Plan, no amendment, modification, suspension or termination of this Agreement shall adversely effect the Award in any material way without the prior written consent of the Holder.

4

3.7 Notices. Notices required or permitted hereunder shall be given in writing and shall be deemed effectively given upon personal delivery or upon deposit in the United States mail by certified mail, with postage and fees prepaid, addressed to the Holder to his address shown in the Company records, and to the Company at its principal executive office.

3.8 Successors and Assigns. The Company may assign any of its rights under this Agreement to single or multiple assignees, and this Agreement shall inure to the benefit of the successors and assigns of the Company. Subject to the restrictions on transfer herein set forth, this Agreement shall be binding upon Holder and his or her heirs, executors, administrators, successors and assigns.

By his or her signature and the Company’s signature below, Holder agrees to be bound by the terms and conditions of the Plan and this Agreement. Holder has reviewed the Plan and this Agreement in their entirety, has had an opportunity to obtain the advice of counsel prior to executing this Agreement and fully understands all provisions of the Plan and this Agreement. Holder hereby agrees to accept as binding, conclusive and final all decisions or interpretations of the Administrator upon any questions arising under the Plan or this Agreement. If Holder is married, his or her spouse has signed the Consent of Spouse attached to this Agreement as Exhibit A.

5

EXHIBIT A TO RESTRICTED STOCK AGREEMENT

CONSENT OF SPOUSE

I,                                               spouse of                             , have read and approve the foregoing Agreement. In consideration of issuing to my spouse the shares of the common stock of Guidance Software, Inc. set forth in the Agreement, I hereby appoint my spouse as my attorney-in-fact in respect to the exercise of any rights under the Agreement and agree to be bound by the provisions of the Agreement insofar as I may have any rights in said Agreement or any shares of the common stock of Guidance Software, Inc. issued pursuant thereto under the community property laws or similar laws relating to marital property in effect in the state of our residence as of the date of the signing of the foregoing Agreement.

A-1