Cellebrite Certified Mobile Examiner Certification Process
This CCME Examination is conducted in two parts:
- Part I - Knowledge Examination (75 minutes)
- Part II - Practical Examination (135 minutes)
Part I – Knowledge Examination is a timed examination that consists of 50 questions. You will have 75 minutes to complete this portion of the CCME Examination. You may skip questions and return to them later. You may change your answers to any question. Once the 75 minutes has elapsed, you will be forced out of the examination and any unanswered questions will be counted as incorrect. If you complete all questions before the allotted time has elapsed, you may select “Finish Attempt” to complete this portion of the CCME Examination.
Part II - Practical Examination consists of three timed practical examinations with each timed individually. You will have 135 minutes to complete this portion of the CCME Examination. It includes 3 sections – one examination each on the Android, iPhone and Blackberry images. You will have 45 minutes to complete each section of the Practical Examination. You will be using Cellebrite's Physical Analyzer software to load and analyze three mobile device image extractions (one each for iOS, Android, and Blackberry). Each device OS specific section of Part II is timed so you should plan to load the mobile device image into Physical Analyzer prior to beginning each timed section.
Before you begin the Part II Practical Examination please ensure that you have several items routinely used in mobile phone examinations present on the forensic workstation:
- A licensed copy of the latest version of UFED Physical Analyzer software installed.
- The CCME mobile device image files unzipped and ready to process or already processed in Physical Analyzer.
- A Multimedia Player that will play a variety of audio and video files commonly found on mobile devices. Please note: Windows Media Player does not have the capability you need to answer some questions in this section so please ensure you have a Multipurpose Multimedia Player installed before you begin this section.
- A Time Decoding Utility
- Decode - freely available here: http://www.digital-detective.net/digital-forensic-software/free-tools
- Mapping and Location Utility to interpret location data
- Google Earth - freely available here: http://www.google.com/earth/download/ge/agree.html
- Google Maps - freely available here: https://www.google.com/maps/
- Any other forensic utilities you would normally use in a deep dive investigation (Irfan view, etc., if you so desire) The CCME Examination assumes you will use Cellebrite Physical Analyzer as a primary tool and supplement with other utilities for verification.
- Additionally, you will need continuous reliable Internet connectivity on the testing machine and access to a browser to consult online external resources when appropriate, as mentioned in previous Cellebrite training classes. You must do independent work but external resources such as http://NumberingPlans.com may be useful. The CCME Examination is timed so organize your investigative tools before beginning the timed portions of the CCME Examination.
The files required for Part II are approximately 4GB in size to download and expand to 36GB. The files are available through the download or they may be shipped to you on a USB Drive after you complete the enrollment process.
If you plan on downloading the files, please allow approximately 2 hours (depending on your Internet connection speed) to complete the download. Please be sure to save the downloaded image files to a location on your system that allows you to easily locate them later.
Do not start the CCME Examination until you have either downloaded the required files or have received a CCME USB Drive.
Note: If you attend one of Cellebrite's Instructor Led CCME Preparation Workshop (not a live online workshop), the CCME USB Drive and/or the CCME mobile device image files will be provided to you during the class.