Kevin Mandia Joins Guidance Software as Director of Incident Response.

Business Editors/High-Tech Writers

PASADENA, Calif.--(BUSINESS WIRE)--Feb. 19, 2004

Renowned Incident Response Expert and Author Will Support Incident

Response Vision and Strategy for Products and Services

Guidance Software Inc., the industry leader in incident response and computer forensics solutions, announced today that Kevin Mandia, one of the world's top computer incident response experts and author of several books on the subject, joined Guidance Software to direct the company's Incident Response practice. This development aligns the leading incident response technology, EnCase Enterprise Edition, with Kevin's expertise and experience in handling hundreds of incident response investigations, ranging from international intrusion investigations to corporate insider hacking cases.

Kevin joins Guidance Software after recently leading Foundstone's incident response practice, where he gained worldwide recognition as an expert in incident response and computer forensics. Prior to joining Foundstone, Kevin served as a Special Agent with the United States Air Force Office of Special Investigations (AFOSI), where he specialized in computer intrusion cases. Upon leaving the AFOSI, Kevin developed a computer intrusion response course specifically designed at the request of the FBI. Kevin trained over 400 FBI agents as well as personnel from the State Department, the CIA, NASA, the U.S. Postal Service, the Air Force and other government agencies. Kevin is a regular speaker at numerous forums, including the Interpol Computer Crime Conference and various conferences hosted by government agencies and law enforcement organizations. He is on the editorial board for the International Journal on Cyber Crime and holds a bachelor of science in computer science from Lafayette College and masters in forensic science from George Washington University.

"Joining the Guidance Software team is a perfect fit because EnCase Enterprise represents a quantum leap in ability of enterprises to utilize incident response and computer forensics," stated Kevin Mandia, director of Incident Response at Guidance Software. "EnCase Enterprise exponentially increases the effectiveness and efficiency of incident response teams, enabling our clients to elevate their game in a big way."

"With Kevin Mandia joining the team, Guidance Software further reinforces our position as the world leader in incident response and computer forensics technology, training, support and services," said John Patzakis, president and CEO of Guidance Software. "We are committed to continuing to provide the best and the most complete enterprise incident response and computer forensics solution to our government and global 2000 customers."

In addition to providing on-demand incident response services, Kevin will work with Guidance Software's government and commercial enterprise customers to help them plan, train and develop their in-house global incident response and computer forensics capabilities.

About Guidance Software

Guidance Software is the leader in computer forensics and incident response solutions. Founded in 1997 and with headquarters in Pasadena, Guidance Software has offices and training facilities in California, Virginia and the United Kingdom. More than 12,000 corporate and government investigators depend on EnCase(R) software, while more than 3,500 investigators attend Guidance Software's forensic methodology training annually. Accepted by numerous courts and honored with eWEEK's Excellence Award and SC Magazine's "Best General Security" Award, EnCase(R) software is considered the standard forensic tool. For more information, visit Guidance Software's Web site at www.guidancesoftware.com.

About EnCase Enterprise Edition

EnCase Enterprise Edition (EEE) is for computer investigators and information security professionals who need to investigate computer breaches and other incidents throughout the enterprise. EEE is a powerful network-enabled incident response and computer forensics system that provides immediate and thorough forensic analysis of volatile and static data on compromised servers and workstations anywhere on the network without disrupting operations. Without EEE, organizations must resort to cumbersome and insufficient manual processes using stand-alone utilities that extend the response and investigation process by several days if not weeks, and require target systems to be taken out of service. This solution brings the highly successful and industry standard EnCase computer forensic technology to the enterprise for unprecedented incident response and investigation capability. EEE represents best practices for immediate incident response and investigation of perimeter breaches and internal threats.