Many things can go wrong.
And I could honestly grow this slide out
to so many different categories that so many things
could go wrong.
You could lose data.
You most likely will void that user's warranty.
So if you're doing consulting investigations
and you're not allowed to damage the device,
rooting will void their warranty.
Their network service provider will
know when they go to turn that device back
in that's been rooted.
If they're using KNOX or Workspace,
it could void that warranty.
You could brick it or ruin the device if you mess it up.
You will change user data of some sort.
You could overwrite some user data of some sort.
You will always leave permanent traces behind.
Always remember that.
And then the final bullet here, is it forensically sound?
I would say, absolutely.
Some people would disagree with me.
In my experience and my practices, whatever
gets you access to the most data, as long it is legal,
lawful, or you have consent, I'm willing to do it.
Be careful, though.
Make sure you understand the level of volatility,
how easy it is to lose data, how to handle
the data to get the very best extraction of these Android
devices.