The Cellebrite Collection Acquisition and Triage (C2AT) course is a combination of Cellebrite’s CCO (Cellebrite Certified Operator) and BlackBag’s BFI (Basic Forensic Investigations) to bring you a Four-Day (28 hours) Intermediate level program. C2AT expands on concepts introduced in Cellebrite Mobile Forensic Fundamentals (CMFF) while introducing extractions and data sets using both Cellebrite and BlackBag products and software. The combined program of CCO and BFI is ideal for professionals working in or seeking to work in areas related to mobile and desktop investigation or data extraction teams.
The CCO portion of the program is designed for investigators to learn about mobile devices, understand general ideas of the forensic process, learn how to seize devices, and review extracted device data using Cellebrite’s Touch2 or 4PC solutions. Participants are introduced to baseline concepts and prerequisite knowledge to understand issues surrounding the handling of mobile devices as evidence while not including data extractions.
The BFI portion of the program is designed for data extraction team members, tasked with
extracting data using BlackBag’s BlackLight or MacQuisition software. Participants will
perform a triage analysis of a full case using digital forensic concepts and advanced functions
of BlackBag software while taking a hands-on investigative approach to extract,
authenticate, analyze, and report on digital evidence found on computers or smartphone
devices running a variety of operating systems. BFI involves the seizure and imaging of
Apple computer systems along with the analysis of Apple, Windows, and iOS data using
The C2AT course introduces extractions and data sets for use case scenarios both on mobile
and desk or laptop devices. The overall focus of is on-screen previews, evidence triage, and
operating Cellebrite (Touch2/4PC), MacQuisition, and BlackLight solutions. Course
participants will use multiple data intelligence tools to conduct basic searches, analyze data,
create bookmarks or tags, and reports in both Cellebrite and BlackBag software. Throughout the course, participants have opportunities to gain the fundamental understanding needed to triage evidence and analyze data
extractions in various case scenarios
|Completion of content modules and passing score of 80% or higher on exam (for certification).|
|More details below|
|Prerequisites / Continued Learning|
|More details below
|Core certification - must be renewed every 2 years.|
|More details below
Students have a 45-day limited time period to access and complete all content, activities, and exams for this class. Access begins on the day the student’s enrollment is confirmed (voucher consumption) and can be monitored in the top left-hand menu of the class homepage, by use of a timer which shows students the number of days remaining for their access.
Students must pass an exam at the end of the course with a minimum score of 80.
Students will receive a maximum of two attempts. If a student fails their first attempt, they must request for their second attempt via Technical Support ticket.
NOTE: No pre-requisites exist to attend the C2AT class, which can be taken to meet the second of three requirements, to qualify for the Cellebrite Certified Mobile Examiner (CCME) certification exam. The C2AT course is NOT available as a test-out out option for those individuals seeking to achieve CCME pre-requisites. Prior knowledge or use of BlackBag’s BlackLight, Cellebrite Touch2, or 4PC is not required to take this course but, it is recommended that students have completed the Cellebrite Mobile Forensics Fundamentals (CMFF), course or test out, prior to this class.
Recommended next course(s) / certification(s):
CCO is a core certification, which is valid for 2 years. Therefore, students are expected to re-certify during their 2nd year of certification.
Full details on the recertification process can be reviewed on the About Cellebrite Certifications page.
8065 Leesburg Pike
Vienna VA 22182
DCA - Reagan International
IAD - Washington Dulles