Guidance Software

What Guidance Software does

Guidance Software developed EnCase, a digital forensic investigation platform used by security investigators, forensic analysts, corporations, and government agencies for data recovery, system analysis, and incident response. The product is built around a Windows kernel driver that provides deep system-level access, enabling investigators to analyze compromised systems, recover digital evidence, and conduct forensic examinations across multiple platforms and data sources. EnCase has been a recognized tool in the digital forensics space for nearly three decades, with established methodology, investigator training ecosystems, and a position among the top 20 digital forensic tools in 2026.

The company's revenue model relied on enterprise and government licensing of its forensic and e-discovery software, with a horizontal go-to-motion targeted at security investigators and forensic practitioners. In 2012, Guidance Software extended its footprint into cloud-based e-discovery document review through the acquisition of CaseCentral for approximately $17.1 million, broadening the platform beyond pure endpoint forensics into legal and corporate discovery workflows. A concurrent 2012 financing round of approximately $7.5 million supported operational scaling during this period.

Guidance Software was publicly traded on NASDAQ under the ticker GUID until 2017, when OpenText acquired the company and integrated it into its security and discovery portfolio. Since the acquisition, Guidance Software no longer operates as an independent entity; EnCase continues as a product line within OpenText, with the primary web presence redirecting to security.opentext.com. The company maintains a global footprint across North America (USA), Europe (UK), and Asia-Pacific (Australia), serving both corporate and government customers, though specific customer logos and revenue split are not publicly disclosed.

Name

Guidance Software

Legal name

Guidance Software

Website

https://security.opentext.com

Company type

Private

Founded year

1996

Operating status

Acquired

Headcount range

501–1,000 employees

Short description

Guidance Software developed EnCase, a digital forensic and incident response platform built on Windows kernel driver technology, serving corporations and government agencies for e-discovery and computer forensics. Acquired by OpenText in 2017; EnCase continues as a product line within OpenText's security portfolio.

Ownership category

akta.pro rank

Product category

Digital Forensics Software

NAICS

Software Publishers (5132), Computer Systems Design Services (541512)

SIC

Services-Prepackaged Software (7372), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

eDiscovery, Litigation Support & Legal Hold (BPAEAPAE)

akta.pro secondary industry

Records Management, Information Governance & Retention (BPAEAPAO)

Keywords

• Digital forensics software
• E-discovery solutions
• Incident response tools
• Endpoint forensics
• Computer forensics platform

Headquarters

HQ city

Pasadena

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Core offering

Guidance Software develops and sells EnCase, a digital forensic and incident response platform used by security investigators, corporations, and government agencies. The software provides data recovery, system analysis, e-discovery, and computer forensics capabilities across various platforms and data sources, built around a Windows kernel driver-based forensic engine. The product is now part of OpenText's security portfolio following the 2017 acquisition.

Product overview

Guidance Software offers EnCase, a digital forensic investigation platform. EnCase provides forensic capabilities for data recovery, analysis, and incident response across various platforms. The product includes a Windows kernel driver component. The company appears to have been acquired by OpenText, as the primary website now redirects to OpenText's security division (security.opentext.com).

Differentiator

Problem solved

Functional benefit

Brands

• EnCase: Digital forensic and incident response toolkit developed by Guidance Software, now part of OpenText's security portfolio.

Products and services

• EnCase Digital forensic tool used by security investigators for data recovery, analysis, and incident response across various platforms and data sources. Includes a Windows kernel driver component that enables deep system-level access for forensic investigations.

Segments1 record

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature1 record

Scale indicators2 records

Recent moves4 records

Expansion highlights3 records

Broad incumbents

• OpenText: OpenText is the parent company that acquired Guidance Software in 2017 and now markets EnCase within its broader enterprise information management and security portfolio. It is the principal distribution and strategic context for EnCase.
• CrowdStrike (Falcon Forensics): CrowdStrike's Falcon platform includes digital forensic and incident response modules that compete with EnCase among enterprise customers modernizing their DFIR tooling onto cloud-native XDR platforms.
• Splunk Enterprise Security: Splunk's security analytics platform is often used alongside or in place of specialized forensic tools for incident investigation, representing adjacent competition to EnCase in security operations workflows.
• Palo Alto Networks (Cortex XDR / Forensics): Palo Alto Networks' Cortex XDR includes forensic and incident response capabilities that overlap with EnCase at the EDR/DFIR intersection, serving enterprise security teams with integrated, cloud-native workflows.

Direct peers

• Relativity (RelativityOne): Relativity's e-discovery platform competes head-to-head with Guidance Software / OpenText's e-discovery offerings for corporate legal teams, law firms, and litigation support services.
• Nuix: Nuix provides forensic investigation, e-discovery, and compliance analytics software. It competes with EnCase in digital forensics and with OpenText's discovery portfolio in e-discovery.
• Magnet Forensics: Magnet Forensics provides digital investigation software (Magnet AXIOM, Magnet GrayKey) used by law enforcement and corporate forensics teams. It directly competes with EnCase in computer and mobile forensic investigations.
• Cellebrite: Cellebrite specializes in mobile forensics and digital intelligence for law enforcement and enterprise investigators. It overlaps with EnCase in investigative workflows, evidence recovery, and incident response use cases.
• Exterro (AccessData): Exterro operates the FTK (Forensic Toolkit) product line, the closest direct competitor to EnCase in endpoint forensics and e-discovery. Both target corporate security teams, law firms, and government investigators with similar digital investigation workflows.

Emerging players

• MSAB (Micro Systemation): MSAB provides mobile forensic tools (XRY) used by law enforcement and corporate investigators. It competes with EnCase in adjacent mobile-device evidence recovery and is frequently paired with or evaluated against EnCase in DFIR toolkits.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks4 records

Key highlights5 records

Customer concentration

• Xx.com/EnCase
• LinkedInlinkedin.com/company/guidance-software

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds1 record

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A1 record

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Guidance Software