Cellebrite Certified Mobile Examiner Certification Process
The CCME certification program is a capstone certification program for Cellebrite’s core mobile forensic track. This certification program is designed to measure the knowledge, skills, and abilities of certification candidates based on the completion of time-limited practical exercises and a proctored knowledge-based examination. Earning the CCME certifies that mobile device examiners have attained a level of mastery in the discipline of mobile device forensic investigation methodology as well as a high degree of proficiency with Cellebrite’s Physical Analyzer software. Earning the CCME requires a high level of working and practical knowledge regarding Cellebrite’s UFED technology. The certification program tests basic knowledge, tool knowledge, and practical experience using two popular mobile device operating systems including Android and iOS.
The CCME Process is governed by the Cellebrite Certification Policy which can be viewed in its entirety here.
The CCME Certification Process is successfully completed by passing two distinct parts.
Practical Skills Assessment
The practical skills assessment is designed to allow the candidate to demonstrate their ability to analyze a known data set through the application of best forensic practices, forensic concepts, and methodologies in the analysis of the data.
Candidates who have attended the Cellebrite Advanced Smartphone Analysis (CASA) course or other advanced smartphone analysis courses, along with investigative experience, should possess sufficient skills to pass the practical skills assessment.
The two practical skills assessments each consist of 15 randomly selected practical assessment questions which require examiners to demonstrate their ability to examine an iOS and Android device extraction to include:
- When to and how to use the Open Advanced dialogue.
- Database analysis techniques (SQLite, etc.).
- How to analyze unsupported (not decoded) iOS and Android applications and related data artifacts.
- How to analyze data artifacts associated with uninstalled applications.
- How to view and decode hexadecimal values.
- How to analyze plist files.
CCME candidates will have a time limit of exactly seven (7) days to complete each of the 15-question assessments. Successful completion of these assessments is achieved by scoring an average of 80% or higher between the two assessments. Upon successful completion of both practical skills assessments, the candidate qualifies to take the CCME Certification Examination.
CCME Certification Examination
The CCME Certification Examination consists of 75 knowledge questions which are randomly selected from a bank of questions based on prerequisite course content (CMFF, CCO, and CCPA). CCME candidates will have a time limit of exactly 3 hours (180 minutes) in a single seating to complete the proctored examination. Candidates may use their notes and course material during the CCME Certification Examination. Successful completion and awarding of the CCME Certification is achieved by scoring 80% or higher on this examination.
Strict Time Limitations:
The CCME process must be completed within 180 days of the candidate’s enrollment date. Failed attempts will require the applicant to restart the certification process again by paying all applicable fees and reapplying. A candidate’s work or personal schedule is not an acceptable excuse for missing this deadline, therefore there is no waiver available for this time limit. Failure to complete the CCME within the 180-day period shall be considered a failed attempt. In addition, individual activities within the CCME process have their own strict timelines which must be adhered to.