To allow a workstation running the Android SDK to communicate with an Android device for forensic purposes, the investigator must enable "USB debugging" mode. This feature is located within the "Developer options" menu of the Android OS. Once enabled, it allows the Android Debug Bridge (ADB) utility, a part of the SDK, to connect to the device over a USB cable. ADB provides command-line access to the device's underlying Linux shell, enabling the investigator to pull files, view system logs (logcat), and perform other essential data extraction tasks.

A. The forensic investigator can enable USB restriction mode on the Android device connected to the external workstation.

This is a security feature that prevents unauthorized USB connections, which is the opposite of what is needed for forensic access.

B. The investigator can turn on upgrade mode on the target device to be examined in the lab setup.

"Upgrade mode" is not a standard Android feature; specific firmware flashing modes exist but are not for general SDK communication.

C. The forensic investigator can trigger recovery mode on the device before connecting to the workstation.

Recovery mode is a separate boot environment for system maintenance. While some ADB commands work here, it is not the standard mode for live forensic analysis.

Android Developers. (n.d.). Run apps on a hardware device. Official Android Developer Documentation. Retrieved from https://developer.android.com/studio/run/device. This official guide states

"To let Android Studio connect to your device

you must enable USB debugging in the device system settings

under Developer options."

Jansen

W.

& Ayers

R. (2012). Guidelines on Mobile Device Forensics (NIST Special Publication 800-101 Revision 1). National Institute of Standards and Technology. Section 4.3.1

"Logical Acquisition

" discusses using vendor-specific tools and protocols

which for Android includes enabling USB debugging to use ADB.

Massachusetts Institute of Technology (MIT). (6.857: Computer and Network Security). Course materials often include labs on mobile security that require students to enable USB debugging to interact with Android devices via ADB for analysis.