Cellebrite Certified Mobile Examiner


Course Description

The CCME certification program is a capstone certification program for Cellebrite’s core mobile forensic track. This certification program is designed to measure the knowledge, skills, and abilities of certification candidates based on the completion of time-limited practical exercises and a proctored knowledge-based examination. (see more details on proctoring below)

Earning the CCME certifies that mobile device examiners have attained a level of mastery in the discipline of mobile device forensic investigation methodology as well as a high degree of proficiency with Cellebrite’s Physical Analyzer software.

The CCME Certification Process is successfully completed by passing two distinct parts.

Practical Skills Assessment

The practical skills assessment is designed to allow the candidate to demonstrate their ability to analyze a known data set through the application of best forensic practices, forensic concepts, and methodologies in the analysis of the data.  

Candidates who have attended the Cellebrite Advanced Smartphone Analysis (CASA) course or other advanced smartphone analysis courses, along with investigative experience, should possess sufficient skills to pass the practical skills assessment. 

The two practical skills assessments each consist of 15 randomly selected practical assessment questions which require examiners to demonstrate their ability to examine an iOS and Android device extraction to include: 

  • When to and how to use the Open Advanced dialogue.
  • Database analysis techniques (SQLite, etc.).
  • How to analyze unsupported (not decoded) iOS and Android applications and related data artifacts.
  • How to analyze data artifacts associated with uninstalled applications.
  • How to view and decode hexadecimal values.
  • How to analyze plist files.

CCME candidates will have a time limit of exactly seven (7) days to complete each of the 15-question assessments.  Successful completion of these assessments is achieved by scoring an average of 80% or higher between the two assessments. Upon successful completion of both practical skills assessments, the candidate qualifies to take the CCME Certification Examination. 

CCME Certification Examination

The CCME Certification Examination consists of 75 knowledge questions which are randomly selected from a bank of questions based on prerequisite course content (CMFF, CCO, and CCPA). CCME candidates will have a time limit of exactly 3 hours (180 minutes) in a single seating to complete the proctored examination. Candidates may use their notes and course material during the CCME Certification Examination.  Successful completion and awarding of the CCME Certification is achieved by scoring 80% or higher on this examination.

Please note: exam is proctored using an automated, self-paced proctoring service that requires the use of a camera connected to the student's PC. There is no need to make appointments, but students must have valid photo identification available to complete the validation process.

Strict Time Limitations: 

The CCME process must be completed within 45 days of the candidate’s enrollment date. Failed attempts will require the applicant to restart the certification process again by paying all applicable fees and reapplying. A candidate’s work or personal schedule is not an acceptable excuse for missing this deadline, therefore there is no waiver available for this time limit. Failure to complete the CCME within the 45-day period shall be considered a failed attempt. In addition, individual activities within the CCME process have their own strict timelines that must be adhered to.

Last modified: Monday, December 5, 2022, 4:00 PM