- Being suspected or charged of destruction of evidence. It happened. - Losing access to forensic data by not capturing the contents of the device RAM. Pretty

- Being suspected or charged of destruction of evidence. It happened. - Losing access to forensic data by not capturing the contents of the device RAM. Pretty common. - Becoming witness of a crime and getting personally targeted by some criminal organization in retaliation. This one should be obvious. - Wasting the opportunity to keep the device on to monitor the activity of the intruder