Cellebrite Certified Mobile Examiner - CCME 2023

Course type: On Line On Demand
Location: On demand
This class has prerequisites. Please login to view them.

About this course

Description

The CCME Process is governed by the Cellebrite Certification Policy.

Purpose: 

The Cellebrite Certified Mobile Examiner CCME certification program is a capstone certification program for Cellebrite’s core mobile forensic track.  This certification program is designed to measure the knowledge, skills, and abilities of certification candidates based on the completion of time-limited practical exercises and a proctored knowledge-based examination.  Earning the CCME certifies that mobile device examiners have attained a level of mastery in the discipline of mobile device forensic investigation methodology as well as a high degree of proficiency with Cellebrite’s Physical Analyzer software. The CCME process requires a high level of working and practical knowledge regarding Cellebrite’s UFED technology and tests forensic fundamental knowledge, tool knowledge, and practical experience using two popular mobile device operating systems including Android and iOS. 

Language: 

The CCME Certification Program is available in the English language only.

Eligibility Requirements: 

The CCME is managed by the Cellebrite Certification Body under the direction of the Director of Certification. Only qualified candidates are eligible to enroll in this process. To be eligible, the CCME candidate applicant must possess the following valid certificates:

  1. Cellebrite Certified Operator (CCO) – Current, non-expired certification
  2. Cellebrite Certified Physical Analyst (CCPA) – Current, non-expired certification
  3. Cellebrite Advanced Smartphone Analysis (CASA)
Cellebrite Mobile Forensic Fundamentals (CMFF) is optional, but highly recommended.


CCME candidates must have:

  • Access to licensed either a UFED Touch/Touch2 or UFED4PC.
  • A computer capable of running UFED Physical Analyzer software.
  • A dongle or software license to use UFED Physical Analyzer software.
  • An internet connection to complete the practical skills assessment online.
  • An active internet connection during the proctored CCME Certification Examination which meets all technical specifications listed at our third-party proctoring service as listed here.

Failure Policy:

A candidate’s work or personal schedule is not an acceptable excuse for missing deadlines, therefore there is no waiver available for the time limits.

A candidate’s failure to have licensed software and/or decode the extractions provided during the process is not an acceptable excuse for a failed attempt.

Failed attempts require the candidates to restart the certification process again, which includes paying all applicable fees and possessing the prerequisites for the process.





Learning objectives

The CCME Certification Process is successfully completed by passing two distinct parts.

The CCME Process is governed by the Cellebrite Certification Policy which can be viewed in its entirety here.

Practical Skills Assessment


The practical skills assessment is designed to allow the candidate to demonstrate their ability to analyze a known data set through the application of best forensic practices, forensic concepts, and methodologies in the analysis of the data.  

Candidates who have attended the Cellebrite Advanced Smartphone Analysis (CASA) course or other advanced smartphone analysis courses, along with investigative experience, should possess sufficient skills to pass the practical skills assessment. 

The two practical skills assessments each consist of 15 randomly selected practical assessment questions which require examiners to demonstrate their ability to examine an iOS and Android device extraction to include: 

  • When to and how to use the Open Advanced dialogue.
  • Database analysis techniques (SQLite, etc.).
  • How to analyze unsupported (not decoded) iOS and Android applications and related data artifacts.
  • How to analyze data artifacts associated with uninstalled applications.
  • How to view and decode hexadecimal values.
  • How to analyze plist files.

CCME candidates will have a time limit of exactly seven (7) days to complete each of the 15-question assessments.  Successful completion of these assessments is achieved by scoring an average of 80% or higher between the two assessments. Upon successful completion of both practical skills assessments, the candidate qualifies to take the CCME Certification Examination. 

CCME Certification Examination

The CCME Certification Examination consists of 75 knowledge questions which are randomly selected from a bank of questions based on prerequisite course content (CMFF, CCO, and CCPA). CCME candidates will have a time limit of exactly 3 hours (180 minutes) in a single seating to complete the proctored examination. Candidates may use their notes and course material during the CCME Certification Examination.  Successful completion and awarding of the CCME Certification is achieved by scoring 80% or higher on this examination.

Strict Time Limitations: 

The CCME process must be completed within 45 days of the candidate’s enrollment date. Failed attempts will require the applicant to restart the certification process again by paying all applicable fees and reapplying. A candidate’s work or personal schedule is not an acceptable excuse for missing this deadline, therefore there is no waiver available for this time limit. Failure to complete the CCME within the 45-day period shall be considered a failed attempt. In addition, individual activities within the CCME process have their own strict timelines which must be adhered to.