Cellebrite Mobile Forensics Fundamentals [CMFF]

    If the scheduled dates above don't suit or if there are no available dates currently listed, but you are interested in the class, kindly fill in your details below to be added to our Register of Interest.


    A member of our training team will contact you with alternative arrangements.


    Online On Demand (OD)
    To participate in this On-Demand course, students must have:
    • A computer capable of running UFED Reader software
    • An active internet connection to take this course online.
    Cellebrite will provide:
    • The appropriate student manual
    • Certain required materials based on the course taken. Click here for a full list of materials required and/or provided.

    NOTE: Estimated delivery of shipments is 5 – 7 days after payment and enrollment are complete.
    Students who do not already have or have access to currently licensed Cellebrite hardware and software are encouraged to take one of our Instructor-Led or Live Online classes.

    Course Access

    Students have a 45-day limited time period to access and complete all content, activities, and exams for this class. Access begins on the day the student’s enrollment is confirmed (voucher consumption) and can be monitored in the top left-hand menu of the class homepage, by use of a timer which shows students the number of days remaining for their access.

    • Following this period, a single 15-day extension can be requested. The student must wait until the number of days reaches 0 days, at which point the countdown will become a button to request an extension of 15-days.
    • Extension requests typically take 1-2 business days to review/approve and limited to a one-time request. If the student fails to complete the course after the approval of the 15-day extension, you may be required to purchase the class again and start over.
      More details on this policy can be viewed here.
    About CMFF

    The 2-day, Cellebrite Mobile Forensics Fundamentals (CMFF) course no longer represents an introduction to forensics, often referred to as the basics. Rapid evolutions in technology and the increasing variety of mobile communication devices and Internet of Things appliance demand more from persons engaged in digital forensics. The CMFF curriculum provides attendees with compulsory digital forensics core knowledge (fundamentals) including: mobile device communication networks, explorations of Android and iOS file systems, extraction methodologies, memory (NAND) functions, and the proper handling of digital evidence for use in administrative, civil, or criminal actions. Moreover, attendees will learn the reasoning and strategies (concepts) used by creditable practitioners and organizations to form the future of digital forensic best practices. Although Cellebrite products are used in CMFF, the course is not a single tool or application centric program. Cellebrite believes a responsibility exists to teach members of the digital forensic community the necessary competencies to conduct exams ethically, using universal professional standards.

    The CMFF course or the credit by examination (test out) equivalent is the first step required in the training path to qualify for the Cellebrite Certified Mobile Examiner (CCME) certification exam. Students considering the CCME Certification are also required to successfully complete the Cellebrite Certified Operator (CCO) course and the Cellebrite Certified Physical Analyst (CCPA) course.

    Students achieve the certification for this course upon passing a knowledge and practical skills assessment with a score of 80% or higher. The only way to earn the certification is by completing the associated course and exam.


    Upon successful completion of this course, the student will be able to:

    • Recognize the legal responsibility in using Cellebrite products
    • Identify mobile device hardware based on physical characteristics using various methods
    • Recognize and describe the four phases of the forensics process
    • Apply best practices when seizing devices to a mock scenario
    • Conduct basic analysis and searches of extracted device data using UFED Reader software
    • Create basic reports using UFED Reader software

    Successful completion of this course is defined as the student being able to demonstrate proficiency in the above learning objectives by passing a knowledge-based assessment with a score of 80% or higher.