INVESTOR'S RIGHTS AGREEMENT

Exhibit 4.1

GUIDANCE SOFTWARE, INC.

INVESTOR’S RIGHTS AGREEMENT

THIS INVESTOR’S RIGHTS AGREEMENT (the “Agreement”) is entered into as of September 26, 2003 by and between Guidance Software, Inc., a California Company (the “Company”) and Matthew Healey (the “Purchaser”).

The parties hereby agree as follows:

1. Pre-Emptive Rights. Subject to the terms and conditions specified in this Section 1, the Company hereby grants to the Purchaser pre-emptive rights with respect to future sales by the Company of its Shares (as hereinafter defined) prior to December 31, 2006. Each time that the Company proposes to offer any shares of, or securities convertible into or exercisable for any shares of, any class of its capital stock (“Shares”), the Company shall first make an offering to the Purchaser so that he has the option to purchase, on a pro rata basis, a portion of such Shares in accordance with the following provisions:

1.1 The Company shall deliver a notice by certified mail (“Notice”) to the Purchaser stating (a) its bona fide intention to offer such Shares, (b) the number of such Shares to be offered, and (c) the price and terms, if any, upon which it proposes to offer such Shares.

1.2 (a) Within 15 calendar days after delivery of the Notice, the Purchaser may elect to purchase or obtain, at the price and on the terms specified in the Notice, up to that portion of such Shares which equals the proportion that (i) the number of shares of Common Stock of the Company acquired by the Purchaser pursuant to that Common Stock and Warrant Purchase Agreement dated September 26, 2003, including shares of Common Stock of the Company issued upon conversion of the Warrant purchased thereunder, and including any adjustments pursuant to Section 8 thereof, and shares of Common Stock received in connection with any stock dividend, stock split or other reclassification thereof (“Purchaser Common Shares”), and then held by the Purchaser, bears to (ii) the total number of shares of Common Stock then outstanding (assuming full conversion and exercise of all convertible or exercisable securities).

(b) Any purchase by the Purchaser under this Section 1 shall be completed at the same closing as that of any third party purchasers.

1.3 The Company may, during the 45-day period following the expiration of the period provided in subsection 1.2(a) hereof, offer the remaining unsubscribed portion of the Shares to any person or persons at a price not less than, and upon terms no more favorable to the offeree than those specified in the Notice. If the Company does not enter into an agreement for the sale of the Shares within such period, or if such agreement is not consummated within 60 days of the execution thereof, the right provided hereunder shall be deemed to be revived and such Shares shall not be offered unless first reoffered to the Purchaser in accordance herewith.

1.4 The pre-emptive rights in this paragraph 1 shall not be applicable to (i) securities issued pursuant in stock split, dividend, combination or the like, with the approval of the Board, (ii) securities issuable or issued to employees, consultants or directors of the Company directly or pursuant to a stock option plan or restricted stock plan approved by the

Board of Directors of the Company, (iii) capital stock, or options or warrants to purchase capital stock, issued to financial institutions or lessors in connection with commercial credit arrangements, equipment financings or similar transactions, the terms of which are approved by the Board of Directors of the Company, (iv) securities issuable upon exercise of warrants outstanding as of the date hereof, or (v) capital stock or warrants or options to purchase capital stock issued in connection with bona fide acquisitions, mergers or similar transactions, the terms of which are approved by the Board of Directors of the Company.

1.5 The rights of the Purchaser set forth in this Section 1 may be assigned (but only with all related obligations) only to a transferee or assignee of all of the Purchaser Common Shares (unless the transferee or assignee is the spouse, child, grandchild or spouse of such children or grandchildren of the Purchaser, or a trust for the benefit of the Purchaser or such persons, in which case the rights of the Purchaser set forth in this Section 1 may be assigned (but only with all related obligations) to a transferee or assignee of less than all of Purchaser’s Common Shares), provided that (a) the Company is, within a reasonable time prior to such transfer, furnished with written notice of the name and address of such transferee or assignee and the securities with respect to which such rights are being assigned, (b) such transferee agrees in writing to be bound by the provisions of this Agreement, and (c) such transferee is not an actual or potential competitor of the Company, as determined in good faith by the Company’s Board of Directors.

2. Registration Rights. The Company and the Purchaser covenant and agree as follows:

2.1 Definitions. For purposes of this Section 2:

(a) The terms “register,” “registered,” and “registration” refer to a registration effected by preparing and filing a registration statement or similar document in compliance with the Securities Act of 1933, as amended (the “Securities Act”), and the declaration or ordering of effectiveness of such registration statement or document;

(b) The term “Registrable Securities” means the Purchaser Common Shares; provided, however, that the foregoing definition shall exclude in all cases (i) any and all Purchaser Common Shares sold by a person in a transaction in which his or her rights under this Agreement are not assigned, and (ii) any and all Purchaser Common Shares that are available for sale by the Purchaser under Rule 144 or another similar exemption under the Securities Act during a three (3)-month period without registration. Notwithstanding the foregoing, Purchaser Common Stock shall only be treated as Registrable Securities if and so long as they have not been (A) sold to or through a broker or dealer or underwriter in a public distribution or a public securities transaction, or (B) sold in a transaction exempt from the registration and prospectus delivery requirements of the Securities Act under Section 4(1) thereof so that all transfer restrictions, and restrictive legends with respect thereto, if any, are removed upon the consummation of such sale;

(c) The term “Holder” means any person of record owning or having the right to acquire Registrable Securities or any assignee thereof in accordance with Section 2.8 of this Agreement;

-2-

(d) The term “Form S-3” means such form under the Securities Act as in effect on the date hereof or any successor form under the Securities Act;

(e) The term “SEC” means the Securities and Exchange Commission; and

(f) The term “IPO” means a firm commitment underwritten public offering by the Company of shares of its Common Stock pursuant to a registration statement under the Securities Act.

2.2 Form S-3 Registration. In case the Company shall receive, at any time after one hundred eighty (180) days after the effective date of the first registration statement (or upon the expiration of applicable underwriters’ lock-ups, if sooner) for a public offering of securities of the Company (other than a registration statement relating either to the sale of securities to employees of the Company pursuant to a stock option, stock purchase or similar plan or an SEC Rule 145 transaction), from any Holder or Holders of the then-outstanding Registrable Securities a written request or requests that the Company effect a registration on Form S-3 (or any successor to Form S-3) or any similar short-form registration statement and any related qualification or compliance with respect to all or a part of the Registrable Securities owned by such Holder or Holders, the Company will:

(a) promptly give written notice of the proposed registration, and any related qualification or compliance, to all other Holders of Registrable Securities; and

(b) as soon as practicable, effect such registration and all such qualifications and compliances as may be so requested and as would permit or facilitate the sale and distribution of all or such portion of such Holder’s or Holders’ Registrable Securities as are specified in such request, together with all or such portion of the Registrable Securities of any other Holder or Holders joining in such request as are specified in a written request given within 15 days after receipt of such written notice from the Company; provided, however, that the Company shall not be obligated to effect any such registration, qualification or compliance, pursuant to this Section 2.2: (i) if Form S-3 or any successor or similar form is not available for such offering by the Holders; (ii) if the Holders propose to sell Registrable Securities in an amount fewer than 20,000 shares of Common Stock (as adjusted for any stock dividend, stock split or other reclassification thereof ); (iii) if the Company shall furnish to the Holders a certificate signed by the President of the Company stating that in the good faith judgment of the Board of Directors of the Company, it would be seriously detrimental to the Company and its stockholders for such Form S-3 Registration to be effected at such time, in which event the Company shall have the right to defer the filing of the Form S-3 registration statement for a period of not more than ninety (90) days after receipt of the request of the Holder or Holders under this Section 2.2; provided, however, that the Company shall not utilize this right more than once in any twelve month period; (iv) if the Company has, within the twelve (12) month period preceding the date of such request, already a registration on Form S-3 for the Holders pursuant to this Section 2.2; or (v) in any particular jurisdiction in which the Company would be required to qualify to do business or to execute a general consent to service of process in effecting such registration, qualification or compliance.

-3-

(c) Subject to the foregoing, the Company shall file a registration statement covering the Registrable Securities and other securities so requested to be registered as soon as practicable after receipt of the request or requests of the Holders.

2.3 Obligations of the Company. Whenever required under this Section 2 to effect the registration of any Registrable Securities, the Company shall, as expeditiously as reasonably possible:

(a) Prior to the filing of the registration statement and each amendment thereof (including any documents incorporated by reference in such registration statement) and each amendment or supplement to the prospectus, make available for inspection by the Holders of Registrable Securities covered by such registration statement and any attorney, accountant or other agent retained by such Holders all relevant financial and other records, pertinent corporate documents and properties of the Company and its subsidiaries, if any, and shall cause the officers, directors and employees of the Company to make reasonably available for inspection all other relevant information reasonably requested by such Holders in connection therewith, in each case as is customary for similar due diligence examinations; provided, however, that any information that is designated in writing by the Company, in good faith, as confidential at the time of delivery of such information shall be kept confidential by the Holders or any such attorney, accountant or agent, unless such disclosure is required by law after notice to the Company, or such information becomes available to the public generally or through a third party without an accompanying obligation of confidentiality.

(b) Prepare and file with the SEC a registration statement with respect to such Registrable Securities and use its best efforts to cause such registration statement to become effective, and, upon the request of the Holders of a majority of the Registrable Securities registered thereunder, keep such registration statement effective for up to one year.

(c) Prepare and file with the SEC such amendments and supplements to such registration statement and the prospectus used in connection with such registration statement as may be necessary to comply with the provisions of the Securities Act with respect to the disposition of all securities covered by such registration statement for up to one hundred twenty (120) days.

(d) Take such action as may be necessary so that (i) any registration statement, and any amendment thereto, and any prospectus forming a part thereof, and any amendment or supplement thereto (and each report or other document incorporated therein by reference in each case) complies in all material respects with the Securities Act and the Securities Exchange Act of 1934, as amended (the “Exchange Act”), and the respective rules and regulations thereunder, (ii) any registration statement, and any amendment thereto, does not, when it becomes effective, contain and untrue statement of a material fact or omit to state a material fact required to be stated therein or necessary to make the statements therein, in the light of the circumstances under which they were made, not misleading and (iii) any prospectus forming part of any registration statement, and any amendment or supplement to such prospectus, does not include an untrue statement of a material fact or omit to state a material fact necessary in order to make the statements, in the light of the circumstance under which they were made, not misleading.

-4-

(e) Furnish to the Holders such numbers of copies of a prospectus, including a preliminary prospectus, in conformity with the requirements of the Securities Act, and such other documents as they may reasonably request in order to facilitate the disposition of Registrable Securities owned by them.

(f) Use its best efforts to register and qualify the securities covered by such registration statement under such other securities or Blue Sky laws of such jurisdictions as shall be reasonably requested by the Holders, provided that the Company shall not be required in connection therewith or as a condition thereto to qualify to do business or to file a general consent to service of process in any such states or jurisdictions.

(g) In the event of any underwritten public offering, enter into and perform its obligations under an underwriting agreement, in usual and customary form, with the managing underwriter of such offering. Each Holder participating in such underwriting shall also enter into and perform its obligations under such an agreement.

(h) Advise each Holder of Registrable Securities covered by such registration statement and, if requested by any such Holder, confirm such advice in writing:

(i) when such registration statement, and any amendment thereto, has been filed with the SEC and when the registration statement or any post-effective amendment thereto has become effective;

(ii) of any request by the SEC for amendments or supplements to such registration statement or the prospectus included therein or for additional information;

(iii) of the issuance by the SEC of any stop order suspending effectiveness of the registration statement or the initiation of any proceedings for that purpose; and

(iv) of the receipt by the Company of any notification with respect to the suspension of the qualification of the securities included in the registration statement for sale in any jurisdiction or the initiation of any proceeding for such purpose.

(i) Use its best efforts to prevent the issuance, and, if issued, to obtain the withdrawal, of any order suspending the effectiveness of any registration statement at the earliest possible time.

(j) Notify each Holder of Registrable Securities covered by such registration statement at any time when a prospectus relating thereto is required to be delivered under the Securities Act of the happening of any event as a result of which the prospectus included in such registration statement, as then in effect, includes an untrue statement of a material fact or omits to state a material fact required to be stated therein or necessary to make the statements therein not misl