Cellebrite Corporate Investigator Fundamentals (CCIF)
4 days
Entry-level course
Course Description
The Cellebrite Corporate Investigator Fundamentals (CCIF) is a 4 Day Entry/Beginner-level course designed for
corporate investigators who deal with internal employee relations, fraud, safety, and security matters. This class is
essential for corporate investigators who want to learn about tools, software, methods, and workflows to investigate
security issues arising incorporate environments.
This class includes hands on basic experience with UFED/4PC, Digital Collector, Inspector, and Physical Analyzer needed in private sector investigations. Learners will be presented with use-case scenarios and methods to find digital intelligence pertinent to situations faced in the corporate space This class does NOT currently include hands on experience with Endpoint Inspector or advanced use of tools or software.
This class includes hands on basic experience with UFED/4PC, Digital Collector, Inspector, and Physical Analyzer needed in private sector investigations. Learners will be presented with use-case scenarios and methods to find digital intelligence pertinent to situations faced in the corporate space This class does NOT currently include hands on experience with Endpoint Inspector or advanced use of tools or software.
Course Content
Private Sector Investigations
- Identify legal considerations
- Recognize terminology used in corporate/private investigations
- Identify types of evidence
- Enact valid preservation techniques
- Identify collection issues for local and remote data
- Combine data for production to outside counsel
Private Sector Case Analysis Workflow
- Recognize the investigative methods of the Corporate Investigative Workflow
- Recognize the investigative methods of the Incident Response Workflow
- Describe the elements of collection and preservation
- Describe the elements of tool-based production and reporting
- Summarize private sector case analysis workflows and investigative methods
Data Expectations Collection Methods
- Recognize the usage of a Mobile Device Management Admin console
- Discuss the methods to acquire data
- Describe the methods to extract data from iOS devices using Cellebrite PA and UFED Touch2 or 4PC
- Conduct checkm8 extractions to perform a full file system extraction
- Use checkm8 to perform extractions using Cellebrite PA and UFED Touch2 or 4PC
- Identify the differences between the extraction of AFU and BFU data
Analyzing Data with Physical Analyzer
- Configure Physical Analyzer
- Use Physical Analyzer to gain understanding of functional usage of the software
- Conduct an Open Advanced action to open an iTunes backup
- Use the Location services features of Physical Analyzer
- Employ the Get More Data option to conduct Location Carving
- Use translation services to translate data within an extraction
- Demonstrate Physical Analyzer software features
Reporting on Mobile Extractions with PA
- Describe the critical elements of digital forensic detail and basic reporting
- Identify artifacts to be included in a report and create a report
- Discuss when artifacts may not need to be included
- Discuss reporting options afforded to the practitioners
- Relate vital forensic best practice to evidence devices and data
- Compile data from a mobile device extraction
Data Expectations Collection Methods
- Recognize the usage and considerations of a using Digital Collector for data collection
- Discuss the methods frequently employed to acquire data from computer devices
- Describe the methods for extracting and verifying data from source computers
- Summary the tools, views, and methods available to perform data collection on Windows and Mac operating systems
Computer Analysis: Inspector
- Recognize the usage and considerations of using Inspector to analyze computer data
- Configure features and functions of Inspector, including user licenses
- Utilize Inspector to open, restore, verify, and archive case files
- Utilize search, filter, tags, and other features to create actionable views within Inspector
Introduction to Endpoint Inspector
- Recognize the usage and considerations of using Endpoint Inspector to collect data
- Recognize the features and functions of Endpoint Inspector
Computer Reporting: Inspector
- Configure the reporting features and functions of Inspector
- Utilize Inspector to add, reorder, identify device details, and generate a report for case files
- Utilize search, filter, tags, and other features to create actionable views within Inspector
Last modified: Monday, January 24, 2022, 9:12 AM