Cellebrite Computer Forensic Fundamentals (CCFF)

4 days
Entry-level course
Course Description
Cellebrite Computer Forensic Fundamentals is a four (4) day entry level course designed to provide users with an introduction to digital forensics methodologies using Cellebrite tools, Digital Collector and Inspector. Whether the goal is to learn the fundamentals for investigative techniques or gain experience with Cellebrite’s tools, the CCFF course provides a perfect opportunity. The course is taught using a full scenario-based investigative tutorial to better merge the different skill levels of attendees. Participants will achieve the CCFF certification upon passing a knowledge skills assessment with a score of 80% or better.

Data Acquisition
- Discuss Digital Collector features and functions
- Review imaging processes for different media
- Discuss imaging Windows vs MacOS
- Discuss live data collection
- Review booting into Digital Collector
- Discuss the proper handling of digital evidence

Inspector Overview
- Explore the Inspector interface
- Review how to create a case and add evidence
- Review how to restore an Inspector archive
- Discuss the processing options
- Discuss how to navigate evidence within Inspector

Tagging and Searching
- Explain tagging varying items of interest
- Practice tagging (singular and multiple) items within Inspector
- Discuss and practice data filtering
- Explore and practice Content Searching
- Discuss using regular expressions
- Explore and practice Index Searching

Data Analysis
- Explore different ways to extract evidence and review media within Inspector
- Discuss hashing and creating custom hash sets and file carving (Mac/Windows)
- Practice running hash sets in Inspector and comparing hashes
- Explore email evidence for both Windows and MacOS
- Discuss internet evidence associated with different internet browsers and the significance of archives
- Explore Windows and MacOS-specific evidence
- Review specialized topics and Inspector collaborations

Reporting
- Explore the reporting feature within Inspector
- Discuss the reporting options
- Practice generating a report within Inspector
- Explore portable case
- Practice generating a portable case
Last modified: Thursday, January 12, 2023, 8:30 AM