EchoTraceAcademyGet a quote

The recognition architecture

Four layers of recognition, from one course to Certified.

A single course earns a Course Certificate. Breadth at a stated Level earns a Level Credential. Depth in one named stream earns a Stream Credential. Above them all sits Professional Certification — ET-CMEP, ET-CMRA, and ET-CMES — the only layer permitted to use the words Certified and Certification. Eligibility never depends on how you paid.

Compare the 4 layers À la carte or All Access
Recognition layers
4course, level, stream, professional
Level Credentials
4Foundation to Specialist
Stream Credentials
10one per technical stream
Top-tier designations
3ET-CMES spans 10 specializations

4 LAYERS, ONE CATALOGUE

The wording is controlled, because the claim is.

Each layer attests to something narrower or wider than the one beneath it, and each is named to match. Certificate belongs to a single course. Credential belongs to a Level or a Stream. Certified and Certification are reserved for the professional tier and its independent assessment. Nothing is awarded automatically: a Course Certificate does not confer a Credential, and a Stream Credential at a Level does not confer the overall Level Credential.

  1. Layer 01

    Course Certificate

    One course, completed and mastered.

    Successful completion and mastery of one EchoTrace course — the smallest unit of recognition the Academy issues, and the one every other layer is built from.

    How it is earned

    1. Complete the course, including its assessed activities.
    2. Meet the approved mastery standard for that course.
    3. The completion is recorded against the technical competencies the course covers.

    Course Certificate in full

  2. Layer 02

    Level Credential

    One standard, held across the prescribed competencies.

    Breadth across the prescribed EchoTrace competencies at a stated Foundation, Practitioner, Advanced, or Specialist Level. It describes how demanding the evidence can get before the holder stops being reliable.

    How it is earned

    1. Complete the courses the Level blueprint prescribes across the required domains.
    2. Demonstrate the required Competency Level in each blueprint competency.
    3. Pass every applicable critical competency — a strong overall score cannot compensate.

    Level Credential in full

  3. Layer 03

    Stream Credential

    One named stream, at a stated Level.

    Specialization within one named EchoTrace Stream at a stated Level. Breadth and specialization are deliberately separated: holding a Stream Credential at a Level does not establish or award the overall Level Credential.

    How it is earned

    1. Complete the stream from its Foundation course upward to the stated Level.
    2. Demonstrate the required Competency Level in that stream’s technical domain.
    3. Pass the applicable critical competencies for the stream and Level claimed.

    Stream Credential in full

  4. Layer 04

    Professional Certification

    The top tier, and the only layer that may say Certified.

    A broader prescribed curriculum plus a controlled independent competency assessment, ending in a human-authorized decision. The three designations are ET-CMEP, ET-CMRA, and ET-CMES in a named specialization.

    How it is earned

    1. Establish eligibility, then complete the prescribed multi-domain curriculum.
    2. Sit every assessment component: knowledge, focused interpretation, practical reconstruction, and defence.
    3. Reach the required Competency Level, pass all applicable critical competencies, and receive a human-authorized decision.

    Professional Certification in full

The four recognition layers compared
Course CertificateLevel CredentialStream CredentialProfessional Certification
What it recognizesMastery of one courseBreadth at a stated LevelSpecialization in one stream, at a stated LevelAssessed professional competence
Awarded againstCourse mastery standardLevel Credential blueprintStream Credential blueprintCertification blueprint plus a human decision
Wording permittedCertificateCredentialCredentialCertified · Certification
Independent assessmentNoPer blueprintPer blueprintYes — controlled and independent
Typical sizeOne courseThe Level courses across the required domainsOne stream, Foundation upwardA prescribed multi-domain curriculum
Available à la carteYesYesYesYes
Available on All AccessYesYesYesYes

LAYER 01 IN FULL — PER COURSE

One course, one certificate, no subscription required.

The Course Certificate is the entry point to everything above it and the only layer a learner can reach by buying a single course. It attests to successful completion and mastery of that course against its approved mastery standard — no more, and it does not claim any wider competence.

What it says

  • The named course was completed and its mastery standard met
  • The competencies that course covers were demonstrated
  • The completion counts toward a Level, Stream, or Professional route later

What it does not say

  • It does not award a Level or Stream Credential automatically
  • It does not use the words Certified or Certification
  • It does not establish general investigative competence

How to start

Every learner begins with the gateway course ET-S00-F01 Technical Mobile Evidence Foundations, then takes any course whose recommended preparation they already meet — one at a time, or as many as the work demands.

Browse all 47 courses See à la carte pricing

LAYER 02 IN FULL — BY LEVEL

Breadth at a stated Level, across the domains you work.

A Level Credential describes how demanding the evidence can get before the holder stops being reliable. It is claimed at one of the four Levels the catalogue teaches and awarded only when the prescribed breadth, critical competencies, and controlled assessment requirements for that Level are satisfied.

  1. Level 01 · Foundation Level · Level Credential

    EchoTrace Level Credential — Foundation

    Recognizes and explains common phone-linked sources, what they record, and where their limits fall.

    Required Competency Level
    Foundation Competency Level in TF and the selected technical domains.
    Assessment emphasis
    Knowledge and guided technical application.

    The Foundation courses that build toward it

  2. Level 02 · Practitioner Level · Level Credential

    EchoTrace Level Credential — Practitioner

    Interprets real records, correlates a limited set of sources, and documents conclusions that trace back to evidence.

    Required Competency Level
    Practitioner Competency Level in TF, IR, and the selected technical scope.
    Assessment emphasis
    Realistic multi-source mobile interpretation.

    The Practitioner courses that build toward it

  3. Level 03 · Advanced Level · Level Credential

    EchoTrace Level Credential — Advanced

    Reconciles conflicting evidence, validates artifacts and tool output, and defends a bounded reconstruction.

    Required Competency Level
    Advanced Competency Level in TF, TR, IR, and the approved technical domains.
    Assessment emphasis
    Independent complex mobile reconstruction and defence.

    The Advanced courses that build toward it

  4. Level 04 · Specialist Level · Level Credential

    EchoTrace Level Credential — Specialist

    Handles uncommon, changing, or platform-specific behaviour, designs validation, and evaluates method limitations.

    Required Competency Level
    Specialist Competency Level in the approved specialist domains, including validation and technical defence.
    Assessment emphasis
    Authoritative analysis within a defined specialty, including how it changes.

    The Specialist courses that build toward it

LAYER 03 IN FULL — BY STREAM

11 streams, 10 Stream Credentials.

Each technical stream maps to exactly one Stream Credential in the same domain, stated at the Level claimed. The common-entry stream carries none of its own: its competencies are assessed inside every credential and every certification. Each stream is also the study route toward the matching ET-CMES specialization at the professional tier.

Every stream, the courses in it, the Levels it can be claimed at, and the credential it supports
StreamCompetency domainCoursesLevels taughtStream Credential
S10Stream 2: Telecommunications EngineeringTE · TE-01..TE-085FoundationPractitionerAdvancedSpecialistTelecommunications Engineering Stream CredentialClaimable to Specialist Level; builds on ET-S10-S01. ET-CMES specialization: Telecommunications Engineering.
S11Stream 3: Carrier EvidenceCE · CE-01..CE-084FoundationPractitionerAdvancedCarrier Evidence Stream CredentialThis stream reaches Advanced Level.
S20Stream 4: Apple Mobile EvidenceAP · AP-01..AP-084FoundationPractitionerAdvancedSpecialistApple Mobile Evidence Stream CredentialClaimable to Specialist Level; builds on ET-S20-S01. ET-CMES specialization: Apple Mobile Evidence.
S21Stream 5: Google and Android Mobile EvidenceGO · GO-01..GO-085FoundationPractitionerAdvancedSpecialistGoogle and Android Mobile Evidence Stream CredentialClaimable to Specialist Level; builds on ET-S21-S01. ET-CMES specialization: Google and Android Mobile Evidence.
S22Stream 6: Microsoft Services on Mobile PhonesMS · MS-01..MS-084FoundationPractitionerAdvancedSpecialistMicrosoft Services on Mobile Phones Stream CredentialClaimable to Specialist Level; builds on ET-S22-S01. ET-CMES specialization: Microsoft Services on Mobile Phones.
S23Stream 7: Third-Party Mobile ApplicationsTA · TA-01..TA-085FoundationPractitionerAdvancedSpecialistThird-Party Mobile Applications Stream CredentialClaimable to Specialist Level; builds on ET-S23-S01. ET-CMES specialization: Third-Party Mobile Applications.
S30Stream 8: Mobile Device ForensicsMF · MF-01..MF-085FoundationPractitionerAdvancedSpecialistMobile Device Forensics Stream CredentialClaimable to Specialist Level; builds on ET-S30-S01. ET-CMES specialization: Mobile Device Forensics.
S40Stream 9: Mobile Timeline ReconstructionTR · TR-01..TR-084FoundationPractitionerAdvancedSpecialistMobile Timeline Reconstruction Stream CredentialClaimable to Specialist Level; builds on ET-S40-S01. ET-CMES specialization: Mobile Timeline Reconstruction.
S50Stream 10: Mobile Spatial AnalysisSA · SA-01..SA-084FoundationPractitionerAdvancedSpecialistMobile Spatial Analysis Stream CredentialClaimable to Specialist Level; builds on ET-S50-S01. ET-CMES specialization: Mobile Spatial Analysis.
S70Stream 11: Integrated Mobile ReconstructionIR · IR-01..IR-084FoundationPractitionerAdvancedSpecialistIntegrated Mobile Reconstruction Stream CredentialClaimable to Specialist Level; builds on ET-S70-S01. ET-CMES specialization: Integrated Mobile Reconstruction.

Open the full course table for every stream

LAYER 04 IN FULL — TOP TIER

The only layer that may say Certified.

A Professional Certification requires a broader prescribed curriculum plus a controlled independent competency assessment and a human-authorized decision. The three designations are ET-CMEP, ET-CMRA, and ET-CMES-[Specialization], each governed by its prescribed curriculum, competency requirements, and assessment blueprint.

  1. ET-CMEP

    EchoTrace Certified Mobile Evidence Practitioner

    Recognizes Practitioner-level competence in TF, IR, and the approved technical scope through a prescribed multi-domain curriculum and a controlled independent assessment.

    Competency Level
    Practitioner
    Domains
    TF, IR, and the approved technical scope
    Assessment emphasis
    Realistic mobile interpretation across several evidence sources.

  2. ET-CMRA

    EchoTrace Certified Mobile Reconstruction Analyst

    Recognizes Advanced-level competence in TF, TR, IR, and the approved technical domains through a prescribed multi-domain curriculum and a controlled independent assessment.

    Competency Level
    Advanced
    Domains
    TF, TR, IR, and the approved technical domains
    Assessment emphasis
    Complex mobile reconstruction and technical defence.

  3. ET-CMES-[Specialization]

    EchoTrace Certified Mobile Evidence Specialist

    Recognizes Specialist-level competence in one named mobile-evidence specialization through the prescribed specialist curriculum and a controlled independent assessment, including validation and technical defence.

    Competency Level
    Specialist
    Domains
    The approved specialist domains for the named specialization
    Assessment emphasis
    Validation, method limitations, and technical defence inside one named specialty.

10 ET-CMES specializations

ET-CMES-[Specialization] is limited to its named specialization and is awarded only when the required Specialist competencies are independently assessed at Specialist Competency Level. Each specialization is taught by the stream beside it.

  1. Telecommunications EngineeringS10 · TE stream
  2. Carrier EvidenceS11 · CE stream
  3. Apple Mobile EvidenceS20 · AP stream
  4. Google and Android Mobile EvidenceS21 · GO stream
  5. Microsoft Services on Mobile PhonesS22 · MS stream
  6. Third-Party Mobile ApplicationsS23 · TA stream
  7. Mobile Device ForensicsS30 · MF stream
  8. Mobile Timeline ReconstructionS40 · TR stream
  9. Mobile Spatial AnalysisS50 · SA stream
  10. Integrated Mobile ReconstructionS70 · IR stream

Assessment components

These four components apply to Professional Certification. They do not automatically apply to a Course Certificate or to a Level or Stream Credential. Component D measures technical meaning and defensibility, not general report-writing style. Overall thresholds and component floors must be established through formal standard setting and pilot evidence.

Component A Technical knowledge validation
20%
Component B Focused technical interpretation tasks
25%
Component C Practical mobile reconstruction
45%
Component D Concise technical explanation and defence
10%

All six must hold

  1. Eligibility established
  2. Every required component completed
  3. Required Competency Level reached in the blueprint competencies
  4. All applicable critical competencies passed
  5. No unresolved technical, integrity, or identity issue
  6. A human-authorized final decision

Five possible decisions

Certified
Every requirement met and a human-authorized final decision recorded.
Not yet certified
One or more requirements unmet. Retakes require focused remediation and an equivalent unexposed form.
Result pending review
Held while a technical, integrity, or identity question is resolved.
Attempt invalidated without penalty
Recorded where the attempt failed for reasons outside the candidate’s control.
Attempt invalidated for verified misconduct
Recorded only after integrity review establishes misconduct.

14 universal critical competencies

Every Professional Certification blueprint selects its applicable critical competencies from this list. An applicable critical competency cannot be compensated for by a high overall score — fail one and the attempt is not certified, whatever the total.

  • TF-01Entity and attribution distinction
  • TF-02Provenance
  • TF-03Event versus interpretation
  • TF-04Synchronization and automation
  • TF-05Source-to-claim traceability
  • TF-06Confidence and limitation
  • TF-07Cross-source correlation
  • TF-08Bounded technical communication
  • TR-01..03Timestamp meaning and normalization
  • TR-04..06Multi-source event correlation
  • SA-02..04Mobile location uncertainty
  • MF-04, MF-07Mobile artifact and tool validation
  • IR-03Attribution across phone, account, subscriber, and person
  • IR-05, IR-08Alternative technical interpretations and revision

MOCK INVESTIGATION LIBRARY

Practice on cases where the evidence contradicts itself.

Whichever layer a learner is working toward, the practice library sits underneath it. Mock investigations are optional practice in applying competencies a learner has already completed. They organize practice; they are not a case-studies course, and they do not teach general investigation.

Three practice modes

Guided practice
Stage prompts, learning-pocket links, and the full hint ladder are available throughout.
Assisted practice
Technical prompts and hints are there when the learner asks for them, not before.
Independent practice
Only procedural, accessibility, and technical-recovery help is active. A full debrief follows.

A four-level hint ladder

Level 1
Orientation prompt.
Level 2
Technical strategy prompt.
Level 3
Approved learning-pocket refresher.
Level 4
A worked partial mobile example that does not reveal the case answer.

Guidance use is recorded for feedback. Asking for help is not automatically treated as failure.

Foundation6 casesFoundation courses

  • ET-MC-001Two Phones, One AccountEntities and synchronization
  • ET-MC-002The Delayed MessageCarrier versus app timestamps
  • ET-MC-003The Shared iPhone AccountApple device and account attribution
  • ET-MC-004The Android BackupDevice versus Google cloud evidence
  • ET-MC-005The Moving PinMobile location uncertainty
  • ET-MC-006Background ActivityUser action versus automation

Practitioner10 casesPractitioner courses

  • ET-MC-101Last Mobile ContactCalls, messages, and phone-linked cloud
  • ET-MC-102The Carrier GapMissing and incomplete provider records
  • ET-MC-103Find My ConflictApple mobile location and synchronization
  • ET-MC-104Timeline DifferenceGoogle location and handset events
  • ET-MC-105The App ConversationMessaging artifacts and attribution
  • ET-MC-106Data SessionIP allocation and handset correlation
  • ET-MC-107Two Time ZonesMobile timestamp normalization
  • ET-MC-108The Synced PhotographMedia creation, sync, and access
  • ET-MC-109Authenticator EventMicrosoft mobile authentication
  • ET-MC-110Phone SwapSIM and eSIM, subscriber, device, and account change

Advanced6 casesAdvanced courses

  • ET-MC-201Conflicting Mobile LocationsMulti-source spatial analysis
  • ET-MC-202Multi-Phone TimelineCarrier, handset, app, and cloud sequence
  • ET-MC-203Incomplete AcquisitionForensic and tool limitations
  • ET-MC-204Version ChangeThird-party app behaviour and validation
  • ET-MC-205Shared Cloud, Different PhonesAttribution and synchronization
  • ET-MC-206Network and Handset ConflictComplex technical reconciliation

Specialist2 casesSpecialist courses

  • ET-MC-301Integrated Mobile ReconstructionComplex multi-source case
  • ET-MC-302Mobile Validation ChallengeControlled disputed-artifact analysis

EXAM SIMULATIONS

Assessment conditions, without an award attached.

Simulations reproduce the format and technical demands of a Professional Certification assessment. Format A matches the shape of a Stream Credential assessment, Formats B and C the shape of a Level Credential or Professional Certification. They are held separately from any live certification material, and exposure is tracked so forms stay calibrated.

Format A

Focused technical simulation

Scope
One technical domain
Duration
Normally 60–120 minutes
  • ET-SIM-001 Carrier and Handset Correlation
  • ET-SIM-002 Apple Mobile Synchronization
  • ET-SIM-003 Google Location and Android Activity
  • ET-SIM-004 Third-Party Messaging Validation
  • ET-SIM-005 Mobile Acquisition Limitations

Format B

Multi-source mobile simulation

Scope
Several technical domains
Duration
Normally 3–5 hours
  • ET-SIM-006 Multi-Source Mobile Timeline
  • ET-SIM-007 Conflicting Mobile Locations
  • ET-SIM-008 Two Phones and Shared Accounts

Format C

Integrated mobile reconstruction simulation

Scope
Complex evidence across multiple sessions
Duration
Normally 6–8 hours
  • ET-SIM-009 Advanced Integrated Mobile Reconstruction
  • ET-SIM-010 Specialist Mobile Validation

Ten readiness criteria

Investigative style is deliberately not one of them. Simulations assess technical interpretation and whether the learner revises when the evidence conflicts.

  1. Mobile source identification
  2. Provenance and traceability
  3. Technical artifact interpretation
  4. Timestamp accuracy
  5. Mobile location accuracy
  6. Correlation and validation
  7. Attribution limits
  8. Uncertainty and alternative technical interpretations
  9. Concise technical communication
  10. Independent revision when evidence conflicts

GOVERNANCE, VALIDITY, AND RENEWAL

The controls behind every recognition decision.

Recognition is only worth what the controls behind it are worth. These are the controls the programme requires and the validity and renewal rules that preserve the meaning of an earned recognition.

The programme requires

  • A Certification Authority
  • Qualified mobile technical assessors
  • Calibrated scoring and moderation
  • Independent appeals and integrity review
  • Accessibility and fairness review
  • Mobile technical advisory review
  • Conflict-of-interest controls
  • Secure case banks and equivalent forms
  • Candidate privacy and record retention rules
  • Public credential-verification controls
Professional Certification validity
Validity and renewal requirements are governed by the applicable certification blueprint.
Course Certificate, Level, and Stream currency
Currency and expiry rules are governed by the applicable controlled blueprint.
Retakes
Require focused remediation and an equivalent unexposed form.
Renewal
Focuses on current mobile platform, carrier, app, acquisition, timestamp, location, validation, and integrated reconstruction competence.

NEXT STEP

Start at the layer that matches the work. Move up when the work does.

Tell us how your unit needs to learn — one targeted course, one shared standard across a squad, a named specialist in one evidence domain, or a route toward an independently assessed designation — and we will map it to a course list, a recognition layer, and a price.

  • Course Certificate: any of 47 courses, bought à la carte or on All Access
  • Level Credential: 4 Levels, Foundation to Specialist
  • Stream Credential: 10 technical streams, each stated at a Level
  • Professional Certification: ET-CMEP, ET-CMRA, and ET-CMES across 10 specializations
Get a price for either route Read the Manual architecture