Cellebrite Certifications
When a student earns certifications from Cellebrite, it means they have demonstrated their ability to meet or exceed competencies for that credential to be issued to them.
A certification credential is awarded to certify that recipient's proficiency as measured by written and practical assessments.
When introducing evidence in criminal and civil proceedings, examiners holding valid Cellebrite certifications are preferred over those who cannot prove their competency.
Some jurisdictions require those who will be introducing evidence in legal proceedings to possess appropriate certifications
These certifications require the completion of one course and final exam.
This will certify the individual in one tool of practice.
These require a set of courses to be completed, along with the passing of a practical assessment and knowledge-based exam to prove your competency.
Capstone Certifications provide a larger value to the individual who intends to move from beginner to expert practitioner. It is also recommended for experienced practitioners to acquire mastery of the Cellebrite suite of products.
To be eligible to recertify a CCO certification, a certification must be current (or expired no more than 24 months)
If a certificant has only earned CCO, they can renew by one of two ways:
- Complete the On Demand CCO Only Recertification Class (details below); or
- Attend and achieve CCPA
To be eligible to recertify a CCPA certification, a certification must be current (or expired no more than 24 months)
If the certificant has earned the CCPA certification, they can renew by one of three ways:
- Complete the on-demand CCPA Only Recertification Class (details below); or
- If they also achieved CCO, they will complete the CCO+CCPA version of the on-demand Recertification Class; or
- Achieve the CCME certification
The Cellebrite Certified Mobile Examiner (CCME) track is designed to prepare practitioners with the knowledge, skills and abilities of mobile device forensics and investigations.
These course tracks also prepare the candidate to utilize Cellebrite’s UFED technology and Physical Analyzer to conduct extractions, analyse findings, and prepare reports for legal proceedings.
The CCME track is made up of:
- Cellebrite Mobile Forensics Fundamentals (CMFF) –
Optional, but highly recommended; you may take the “CMFF Test Out Exam” if you wish to test out of this course - Cellebrite Certified Operator (CCO)
- Cellebrite Certified Physical Analyst (CCPA)
- Cellebrite Advanced Smartphone Analysis (CASA)
To qualify for the CCME Practicals and Exam, the core certifications (CCO & CCPA) must be in active status, and the CASA advanced courses must be completed.
The CCME Certification is valid for two years. Recertification is required every 2 years to maintain an active CCME status.
Learn more at the CCME FAQ page.
The Cellebrite Certified Computer Examiner (CCCE) track is designed to prepare practitioners with the knowledge, skills and abilities of computer device forensics and investigations. These course tracks also prepare the candidate to utilize Cellebrite’s Digital Collector and Inspector technology to conduct extractions, analyse findings, and prepare reports for legal proceedings.
The CCCE track is made up of:
- Cellebrite Computer Forensics Fundamentals (CCFF) –
Optional, but highly recommended; you may take the “CCFF Test Out Exam” if you wish to test out of this course - Cellebrite Apple Forensics Fundaments (CAFF)
- Cellebrite Apple Intermediate Forensics (CAIF)
- Cellebrite Apple Advanced Forensics (CAAF)
- Cellebrite Windows Forensics Investigations (CWFI)
To qualify for the CCCE Practicals and Exam, all Apple and Windows courses must be completed first.
The CCCE Certification is valid for two years. Recertification is required every 2 years to maintain an active CCCE status.
Learn more at the CCCE FAQ page.
The Cellebrite Certified Recovery Specialist (CCRS) track is a hardware-based track designed to prepare practitioners with the knowledge, skills, and abilities to identify potential electronic evidence, properly collect data and extract data on multiple digital devices – including smart devices, vehicle GPS, drones, IoTs, and many others. These course tracks also prepare to recover destroyed or encrypted evidence using destructive and non-destructive methods.
The CCRS track is made up of: :
- Cellebrite Mobile Forensics Fundamentals (CMFF) –
Optional, but highly recommended; you may take the “CMFF Test Out Exam” if you wish to test out of this course - Cellebrite Certified Operator (CCO)
- Cellebrite Apple Intermediate Forensics (CAIF)
- Cellebrite In System Programming (CISP)
- Cellebrite Chip Off Forensics (CCOF)
- Cellebrite Evidence Recovery Technician – Forensics (CERT-F)
To qualify for the CCRS Exam, all practicals must have been completed independently during the course. Students are expected to declare at each training event the intention on pursuing the certification.
The CCRS Certification is valid for three (3) years. Recertification is required every 3 years to maintain an active CCRS status.
Learn more at the CCRS FAQ page.
Effective: 1 January 2023
Note the Certified Blacklight Examiner (CBE) Certification has been discontinued. Cellebrite Computer Forensics Fundamentals (CCFF) has replaced the CBE certification requirements and curriculum.
The CCFF course offers a Certificate of
Completion that does not expire. Existing holders of the CBE will be
automatically granted the Certificate of Completion for the CCFF. The changes
will appear in their records by Aug 2022.
For CCFF holders, the natural next step in pursuit of continuing education is to pursue the CCCE Capstone Certification.
Effective: 1 January 2021
Please be advised that the certifications that were previously granted by Blackbag prior to 2019 have been discontinued, but will remain valid until expiration.
For previously certified CMO and MiCFE certificants, the natural next step in pursuit of continuing education is to purse the CCCE Capstone Certification.