Cellebrite Collection Acquisition and Triage (C2AT) Training

Date: 23 - 26 Feb 2021 Days: Tue-Fri Hours: 9:00 AM - 5:00 PM
Course type: Instructor Led
Region: North America
Location: Vienna, VA, United States
Enroll by: 23 Feb 2021
Log in to see the options to register for this course. If you do not already have an account, create your FREE account. Creating an account does not obligate you to enroll or pay for classes.

About this course


The Cellebrite Collection Acquisition and Triage (C2AT) course is a combination of Cellebrite’s CCO (Cellebrite Certified Operator) and BlackBag’s BFI (Basic Forensic Investigations) to bring you a Four-Day (28 hours) Intermediate level program. C2AT expands on concepts introduced in Cellebrite Mobile Forensic Fundamentals (CMFF) while introducing extractions and data sets using both Cellebrite and BlackBag products and software. The combined program of CCO and BFI is ideal for professionals working in or seeking to work in areas related to mobile and desktop investigation or data extraction teams. 

The CCO portion of the program is designed for investigators to learn about mobile devices, understand general ideas of the forensic process, learn how to seize devices, and review extracted device data using Cellebrite’s Touch2 or 4PC solutions. Participants are introduced to baseline concepts and prerequisite knowledge to understand issues surrounding the handling of mobile devices as evidence while not including data extractions. 

The BFI portion of the program is designed for data extraction team members, tasked with extracting data using BlackBag’s BlackLight or MacQuisition software. Participants will perform a triage analysis of a full case using digital forensic concepts and advanced functions of BlackBag software while taking a hands-on investigative approach to extract, authenticate, analyze, and report on digital evidence found on computers or smartphone devices running a variety of operating systems. BFI involves the seizure and imaging of Apple computer systems along with the analysis of Apple, Windows, and iOS data using BlackBag software.

The C2AT course introduces extractions and data sets for use case scenarios both on mobile and desk or laptop devices. The overall focus of is on-screen previews, evidence triage, and operating Cellebrite (Touch2/4PC), MacQuisition, and BlackLight solutions. Course participants will use multiple data intelligence tools to conduct basic searches, analyze data, create bookmarks or tags, and reports in both Cellebrite and BlackBag software. Throughout the course, participants have opportunities to gain the fundamental understanding needed to triage evidence and analyze data extractions in various case scenarios

Completion Requirements
Completion of content modules and passing score of 80% or higher on exam (for certification).
More details below
Prerequisites / Continued Learning
No prerequisites

More details below
Recertification Requirements
Core certification - must be renewed every 2 years.
More details below

Course Access

Students have a 45-day limited time period to access and complete all content, activities, and exams for this class. Access begins on the day the student’s enrollment is confirmed (voucher consumption) and can be monitored in the top left-hand menu of the class homepage, by use of a timer which shows students the number of days remaining for their access.

More details on this policy can be viewed here.

Completion Requirements

Students must pass an exam at the end of the course with a minimum score of 80.
Students will receive a maximum of two attempts. If a student fails their first attempt, they must request for their second attempt via Technical Support ticket.

Prerequisites and Continued Learning


NOTE: No pre-requisites exist to attend the C2AT class, which can be taken to meet the second of three requirements, to qualify for the Cellebrite Certified Mobile Examiner (CCME) certification exam. The C2AT course is NOT available as a test-out out option for those individuals seeking to achieve CCME pre-requisites. Prior knowledge or use of BlackBag’s BlackLight, Cellebrite Touch2, or 4PC is not required to take this course but, it is recommended that students have completed the Cellebrite Mobile Forensics Fundamentals (CMFF), course or test out, prior to this class.

Recommended next course(s) / certification(s):

Recertification Requirements

CCO is a core certification, which is valid for 2 years. Therefore, students are expected to re-certify during their 2nd year of certification.
Full details on the recertification process can be reviewed on the About Cellebrite Certifications page.

Class details


8065 Leesburg Pike

Suite T3-302

Vienna VA 22182  

DCA - Reagan International

IAD - Washington Dulles

Tysons Corner Marriott
8028 Leesburg Pike, Tysons, VA 22182
(703) 734-3200