CCPA practice examsIn development
Cellebrite Certified Physical Analyst
Mobile forensics at the physical level with Cellebrite UFED and Physical Analyzer: why sealed, encrypted, always-on phones resist ordinary imaging, the ladder of logical, file-system and physical extraction with only the last recovering deleted data, and seizure and isolation where a Faraday bag and the Before/After First Unlock state largely set what is recoverable; then decoding an extraction in Physical Analyzer, recovering deleted records from SQLite unallocated pages and the write-ahead log by hand, verifying the tool's decoding, timestamps and attribution against raw data, and reporting defensibly.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Mobile acquisition and extraction types | Not published |
| Analysis, artefacts and reporting | Not published |
Two sample questions
1. A message thread appears altered. Which practice is appropriate?
- Report the thread exactly as it is presented by the parsing tool
- Examine the underlying database and note any sign of alteration — correct
- Exclude the thread because its integrity is in question
- Re-acquire the device to see whether the thread changes
Why: Examining the underlying database and noting any signs of alteration is appropriate when a thread appears altered.
2. What does a timeline view in Physical Analyzer show?
- Events ordered across the device — correct
- Only the messages that are currently live
- The warrant scope for the case
- The chain of custody record
Why: It places calls, messages and other events in chronological order to reveal a sequence. It draws on the decoded artefacts.
The real CCPA exam
| Length | A proctored practical and knowledge examination |
|---|---|
| Questions | A knowledge exam plus a hands-on analysis of a physical extraction |
| Pass mark | Set by Cellebrite |
| Price | Included with the associated Cellebrite training courses |
| Recommended before you sit it | The Cellebrite mobile forensics course path, culminating in the physical analyst training, is the intended preparation. |
| Valid for | 2 years, renewed through continuing activity |
Exam facts as published by Cellebrite; always check the vendor’s page before you book.
Study CCPA with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.