The Cellebrite Certified Operator (CCO) course is a 2-day intermediate level certification program which builds on the concepts from the CMFF course. This course is designed for those participants tasked with extracting data in a forensically sound manner using UFED Touch or UFED 4PC. This course aims to teach data extraction team members such as technically savvy investigators, digital forensic examiners, IT staff, internal affairs investigators, first responders and personnel designated to handle the extraction of digital evidence how to perform extractions on a variety of devices. These extractions include logical, file system and physical extractions from mobile devices as well as SIM cards, and external storage such as SD cards. Participants in this course will gain a basic understanding of how to open the extractions in Physical Analyzer software, conduct basic searches and how to create bookmarks and reports.
NOTE: It is strongly recommended that students attending this course complete the Cellebrite Mobile Forensics Fundamentals (CMFF) course or test out prior to attending.
The CCO course is comprised of the following modules and lessons:
- Forensic Handling of Mobile Devices
- Touch2 and 4PC Familiarization
- Cellebrite Extraction Methodology
- Triage Reporting
Participants are offered an optional written examination and a practical skill challenge at the class conclusion. Successful completion of the exam and skill challenge results in a Cellebrite Certified Operator (CCO) certification credential. Successful course completion without attempting or passing the optional exam and skill challenge results in a certificate of attendance.
Attaining the CCO certification credential, while optional, is a prerequisite for taking the Cellebrite Certified Mobile Examiner (CCME) test. Demonstration of mastery of these concepts is one of the prerequisites for students desiring to take the Cellebrite Certified Mobile Examiner (CCME) certification examination. Students considering the CCME certification credential are also required to complete the Cellebrite Mobile Forensic Fundamentals (CMFF) course or Cellebrite Mobile Forensic Fundamentals (CMFF) Test Out Option and the Cellebrite Certified Physical Analyst (CCPA) course.
Cellebrite Certified Operator
Upon successful completion of this class, the student will be able to:
- Install and configure UFED Touch, UFED Touch 2 or UFED 4PC and Physical Analyzer software.
- Exhibit how to open extractions using Physical Analyzer.
- Summarize how to conduct basic searches using Cellebrite Physical Analyzer.
- Outline how to create reports using Cellebrite Physical Analyzer.
- Demonstrate proficiency of the above learning objectives by passing a knowledge test and practical skills assessment with a score or 80% or better.
- Explain the best practices for the on-scene identification, collection, packaging, transporting, examination and storage of digital evidence data and devices.
- Display best practice when conducting cell phone extractions.
- Identify functions used within UFED Touch, UFED Touch 2 or UFED 4PC to perform supported data extractions.