Cellebrite Certified Operator (CCO)
2 days
Intermediate-level course
Course Description
It aims to teach data extraction on a variety of devices to personnel including technically savvy investigators, digital forensic examiners, IT staff, internal affairs investigators, first responders and other staff members designated to handle extraction of digital evidence.
Course Content
Mobile Device Technology Overview
- Identify mobile device hardware and operating systems.
- Discuss how mobile devices communicate.
- Discuss how technology affects network capacity.
- Learn how devices and subscribers are identified on networks.
Forensic Handling of Mobile Devices
- Recognize legal considerations for seizing and searching devices
- Identify evidence handling procedures on scenes involving mobile devices
- Use UFED Phone Detective to identify a specific mobile device
- Recognize various locking mechanisms found on mobile devices
- Practice applying best practices when seizing devices to a mock scenario
UFED Touch and UFED 4PC
- Learn about the components for the UFED Touch and UFED 4PC
- Learn how to license UFED technology
- Learn to update the firmware
- Install UFED 4PC
- Configure UFED Touch and/or UFED 4PC
Cellebrite Extraction Methodology
- Identify best practices for digital forensic extractions
- Practice forensically sterilizing media
- Complete SIM card extractions using UFED Touch/4PC
- Conduct SD card extractions in a forensically sound manner
- Use the UFED Touch/4PC and Physical Analyzer to conduct device extractions
- Complete the removal of a passcode from a locked device using UFED Touch/4PC
- Describe how to use UFED Camera Services
Introduction to Analyzing User Data
- Basic Physical Analyzer Configuration
- Open extractions with Physical Analyzer
- View data in Physical Analyzer
- Learn to bookmark items of interest
Reporting on Technical Findings
- Understand the fundamental elements of a report
- Understand reporting options within Physical Analyzer
- Create a report based on evidentiary items
Participants are offered an optional certification examination at the conclusion of class. Successful completion of the exam results in a Cellebrite Certified Operator (CCO) certification credential. Successful course completion without attempting or passing the optional exam and skill challenge results in a certificate of attendance.
Attaining the CCO certification credential, while optional, is a prerequisite for taking the Cellebrite Certified Mobile Examiner (CCME) test. Demonstration of mastery of these concepts is one of the prerequisites for students desiring to take the Cellebrite Certified Mobile Examiner (CCME) certification examination. Students considering the CCME certification credential are also required to complete the Cellebrite Mobile Forensic Fundamentals (CMFF) course or Cellebrite Mobile Forensic Fundamentals (CMFF) Test Out Option and the Cellebrite Certified Physical Analyst (CCPA)