Cellebrite Certified Operator (CCO)



2 days
Intermediate-level course

Course Description

The Cellebrite Certified Operator (CCO) course is a 2-day intermediate level certification program which builds on the CMFF course concepts. This course is designed for participants tasked with extracting data in a forensically sound manner using UFED Touch or UFED 4PC.

It aims to teach data extraction on a variety of devices to personnel including technically savvy investigators, digital forensic examiners, IT staff, internal affairs investigators, first responders and other staff members designated to handle extraction of digital evidence.




NOTE: It is strongly recommended that students attending this course complete the Cellebrite Mobile Forensics Fundamentals (CMFF) course or test out prior to attending.

Course Content

sidebar image 
Mobile Device Technology Overview
  • Identify mobile device hardware and operating systems.
  • Discuss how mobile devices communicate.
  • Discuss how technology affects network capacity.
  • Learn how devices and subscribers are identified on networks.
sidebar image 
Forensic Handling of Mobile Devices
  • Recognize legal considerations for seizing and searching devices
  • Identify evidence handling procedures on scenes involving mobile devices
  • Use UFED Phone Detective to identify a specific mobile device
  • Recognize various locking mechanisms found on mobile devices
  • Practice applying best practices when seizing devices to a mock scenario
sidebar image
UFED Touch and UFED 4PC
  • Learn about the components for the UFED Touch and UFED 4PC
  • Learn how to license UFED technology
  • Learn to update the firmware
  • Install UFED 4PC
  • Configure UFED Touch and/or UFED 4PC
sidebar image
Cellebrite Extraction Methodology
  • Identify best practices for digital forensic extractions
  • Practice forensically sterilizing media
  • Complete SIM card extractions using UFED Touch/4PC
  • Conduct SD card extractions in a forensically sound manner
  • Use the UFED Touch/4PC and Physical Analyzer to conduct device extractions
  • Complete the removal of a passcode from a locked device using UFED Touch/4PC
  • Describe how to use UFED Camera Services
sidebar image
Introduction to Analyzing User Data
  • Basic Physical Analyzer Configuration
  • Open extractions with Physical Analyzer
  • View data in Physical Analyzer
  • Learn to bookmark items of interest
sidebar image
Reporting on Technical Findings
  • Understand the fundamental elements of a report
  • Understand reporting options within Physical Analyzer
  • Create a report based on evidentiary items

Participants are offered an optional certification examination at the conclusion of class. Successful completion of the exam results in a Cellebrite Certified Operator (CCO) certification credential. Successful course completion without attempting or passing the optional exam and skill challenge results in a certificate of attendance.

Attaining the CCO certification credential, while optional, is a prerequisite for taking the Cellebrite Certified Mobile Examiner (CCME) test. Demonstration of mastery of these concepts is one of the prerequisites for students desiring to take the Cellebrite Certified Mobile Examiner (CCME) certification examination. Students considering the CCME certification credential are also required to complete the Cellebrite Mobile Forensic Fundamentals (CMFF) course or Cellebrite Mobile Forensic Fundamentals (CMFF) Test Out Option and the Cellebrite Certified Physical Analyst (CCPA)

Last modified: Tuesday, August 17, 2021, 7:18 AM