During a forensic investigation involving an Android device, the investigator needs to establish communication between...

This question maps directly to CHFI v11 objectives under Mobile and IoT Forensics , specifically Android device acquisition and analysis procedures. In Android forensics, communication between the device and a forensic workstation running the Android SDK is primarily achieved using the Android Debug Bridge (ADB) . ADB enables investigators to interact with the device’s file system, retrieve logs, execute commands, and collect forensic artifacts in a controlled manner.

To use ADB, USB Debugging mode must be enabled on the Android device. CHFI v11 explicitly highlights USB debugging as a critical prerequisite for logical acquisition, live data collection, and application-level analysis on Android devices. When enabled, it allows authenticated communication between the device and the forensic workstation without requiring intrusive methods that could alter evidence unnecessarily.

USB restriction mode limits data communication, recovery mode is used mainly for system repairs or flashing firmware, and “upgrade mode” is not a standard Android forensic feature. None of these allow normal SDK-based interaction for forensic analysis. Therefore, consistent with CHFI v11 Android forensic methodology, enabling USB debugging mode is the correct and essential step to establish communication with the Android SDK workstation.