CUFO On Line On Demand

Course type: On Line On Demand
Location: On demand
Log in to see the options to register for this course. If you do not already have an account, create your FREE account. Creating an account does not obligate you to enroll or pay for classes.

About this course



To participate in this On-Demand course, students must have:

  • A computer capable of running UFED Field software.
  • A UFED Field Kiosk or computer capable of running UFED Field Kiosk applications software solutions.
  • A dongle or software license to use UFED Field software and Kiosk solutions (this is not included in the purchase price of this class).
  • An active high-speed internet connection to take this course online.

 Cellebrite will provide:

  • The appropriate student manual within the course as an e-book. Duplicating and distributing of the student manual is not allowed and subject to copyright infringement.
  • All manuals, resources, and data will be provided within the course environment; there will be no accompanying manual or equipment shipped to students as part of this class.  
  • Certain required materials based on the course taken. Click here for a full list of materials required and/or provided.

Time Limit: Participants will have access to the course and all associated course resources for three months (90 days).

Students who do not already have or have access to currently licensed Cellebrite hardware and software are encouraged to take one of our Instructor-Led or Live Online classes.

Course Access

Students have a 90-day limited time period to access and complete all content, activities, and exams for this class. Access begins on the day the student’s enrollment is confirmed (voucher consumption) and can be monitored in the top left-hand menu of the class homepage, by use of a timer which shows students the number of days remaining for their access.

  • Although this is a self-paced fully online class, we suggest students follow a similar schedule to the instructor-led format (provided in the next section) in order to ensure they successfully complete the entire class, before their access period expires.
  • In the event that additional access time is needed, the student must wait until the number of days reaches 0 days, at which point the countdown will become a button to request an extension of 30-days. You will not be able to request the extension prior to the expiration of those days, to ensure you get an additional full-term for the request.
  • Extension requests typically take 1-2 business days to review/approve and limited to a one-time request. If the student fails to complete the course after the approval of the 30-day extension, you may be required to purchase the class again and start over.

About CUFO

NOTICE: This course is for UFED InField Software and Kiosk-based solutions only. It is not training in our Pro Series Forensic Core classes that use UFED Touch, UFED4PC, and our Logical/Physical Analyzer Software. 

The Cellebrite UFED Field Operators (CUFO) Course is designed for examiners with little exposure to or experience in mobile device forensics. This 1-day course focuses on the use of Cellebrite’s UFED Kiosk to perform logical extractions, password bypasses and the analysis of evidentiary items using the UFED InField software. 

This course exposes students to the fundamentals of mobile device investigations, extraction of user data, and analysis of mobile devices using the UFED Kiosk. Operation of the Cellebrite UFED Kiosk product to perform a number of hands-on logical extractions on various mobile devices with a variety of operating systems is a key component of this class. Skill sets also include creating Safety SIMs and extracting evidentiary data from SIM cards. Participants also create reports on extracted data. It should be noted that times allocated to course content do not include course introduction or examination time.

Learning objectives

CUFO Course Learning Objectives

Mobile Device Technology Overview

In this module, you will obtain a baseline of how cellular devices operate and discuss possible artifacts of interest from an investigative point of view.

  • Identify mobile device hardware
  • Develop an understanding of how devices communicate 
  • Describe where mobile device information can be stored

Data Locations

In this module, you will learn where data can be stored on a mobile device. You will also be introduced to the UFED Kiosk and UFED InField software, the various types of extractions and some of the challenges encountered in mobile device examination.

  • Identify data locations, flash memory, SIM and storage cards • Discuss cloud-based storage
  • Understand UFED Kiosk and UFED InField software
  • Describe the different extractions and various challenges

Forensic Handling of Mobile Devices

In this module, you will learn about industry standard collection techniques involving mobile devices and discuss the implications for pertinent digital evidence recovery.

  • Learn about industry standard mobile device collection techniques 
  • Discuss the implications for pertinent digital evidence recovery

UFED Kiosk Tour

In this module, you will take a tour of the UFED Kiosk and be introduced to its features. You will learn how to connect mobile devices and how to save your data.

  • Discuss how to connect to UFED Kiosk
  • Discuss how to connect the UFED camera 
  • Learn how to operate the UFED Kiosk

SIM Extraction with UFED Kiosk

In this module, you will be introduced to a SIM card data extraction. You will learn how to create a safety SIM (network isolation card).

  • Extract SIM data
  • Understand SIM data
  • Discuss SIM types
  • Understand the use of SIM clone cards
  • Create a safety SIM (network isolation card)

Mobile Device Extraction with UFED Kiosk

In this module, you will be introduced to mobile device data extraction using the UFED Kiosk. You will perform an extraction and use the UFED camera.

  • Describe the importance of identifying devices
  • Discuss necessary configuration changes
  • Discuss the use of the UFED camera
  • Discuss methods of extracting and bypassing passwords 
  • Discuss extraction methods
  • Extract mobile data

SD Card Extractions with UFED Kiosk

In this module you will be introduced to storage card (SD) data extraction using the UFED Kiosk. You will understand the importance of write-blocking while performing extractions.

  • Describe and perform data extractions from storage cards 
  • Discuss the use of a write blocker/card reader
  • Discuss the process of viewing extracted data

Viewing Data using the UFED Kiosk

In this module you will learn to view the extracted data on the UFED Kiosk. You will learn how to use filters, watch lists and tag (bookmark) items of interest. You will be introduced to reports and how to save data including reports and extracted data.

  • Describe how to examine the data from mobile devices 
  • Discuss how to filter and tag (bookmark) data
  • Discuss how to create, import, and use watch lists
  • Discuss methods for creating reports
  • Discuss how to save reports and extraction data

Class details