I just saw this course listed online. 3 days and around 1500 bucks. Has anyone taken this and would you recommend it?
In my area the Cellebrite is standard equipment in the basic ICAC package. It's pretty simple and essentially all you are doing is transferring data. I was wondering if anyone has been asked by an Attorney if they were certified on it or could you bluff your way by mentioning some other school related to cell phone tech or data recovery?
Thanks!
I don't know about the need of being "Cellebrite Certified"…. I use Cellebrite on a daily basis…. I also use EnCase on a daily basis and while I'm going to pursue EnCE cert in 2011, it's not a requirement…
I wouldn't try to "bluff" your way in Court - credibility is the only thing you have, should you loose that because you're trying to "bluff", you're done.
Be honest in the training you've received and in the research you've done - while I use enscripts with encase, I can also go in and seek that data I need manually. Reading and research certainly counts towards your knowledge and you can mention that….
In Canada, before being able to give opinion evidence, one needs to be declared an expert - that's done by having your CR reviewed and answering questions while on the stand - under oath - trying to bluff your way through that would lead to a short lived forensic career.
Well said ForensicRanger. You might be able to "bluff" for a while but eventually, the truth will be revealed. Better to be up front and honest and let the jury decide the validity of your exam as it stands than to have it and all your other case scrutinized on appeal later.
I also concur that not having a "Cellebrite Cert" (or any other for that matter) does not preclude the examiner from using the device. As long as an examiner knows how to correctly use the device (user manual) and has tested the results with other tools, it shouldn't be a problem.
In a sense my word "bluff" meant that I would try and highlight a certification in cell phone technology and forensic data recovery. I also could say that I have sucessfully used the Cellebrite in a supervised classroom environment. That "might" keep someone from asking directly about a specific certification on the device. However, if I were asked I would admit that I was not "certified" on the device.
I recently posed the question of Cellebrite certification to someone that works in the cellular forensics industry. Their opinion was "Cellebrite’s response to this is that their product itself has a history of acceptance in court, and the simplicity of their device doesn’t allow mistakes to happen by the examiner (data to be tampered with)."
Whether or not this is their position I feel it is better if possible to get the certification. I can see myself telling the defense attorney "Sir, it's idiot proof.LOL." I'd kind of like to know what is going on while I'm pressing the buttons. Maybe the owners manual spells that out, but I certainly wouldn't turn down any class if I can get into one.
"Bluff deceive an opponent by a bold bet on an inferior hand with the result that the opponent withdraws a winning hand"
To highlight one's education and training is, imho, not at all close to bluffing…
I would concur with your articulation in relation to training received - you've used Cellebrite in a supervised environment to the satisfaction of the facilitator(s).
If asked whether or not you're certified on the device - be honest - you're not "admitting" that you're not certified, this would imply that you've "bluffed" or misrepresented your credentials.
I agree that one needs to know what is going on (see my post on using enscripts to expedite the process of retrieving data but knowing how to do it manually to verify… you verify your tools, right?) Push button forensics is fine as long as you're not taken to task in court - you best have your t's crossed and i's dotted (ergo knowing what happens when the button is pushed.) Everytime you use Cellebrite to retrieve data, you must do a manual verification of the data on the device that was pulled from the device to ensure it matches. If it doesn't match, why not? I like going using Cellebrite's FS Dump feature to pull out the FS and then examine it, thereby doing a manual verification of everything that was pulled.
Certification is nice, but it's not widely offered and you have to keep in mind budget and travel restraints.. if we w/could go and obtain every course and certificate available, we'd be too busy being on courses than to get any work done )
Having had our local (Australian) cellebrite rep provide certifications for a bunch of our staff after a 15min training and assessment session (including some who had close to zero previous phone expertise) this is not a certification I would value highly.
Actually the 15minutes is probably an exaggeration, it would have been closer to half an hour, but you get the idea.