Not difficult to guess. Most probably, looking for possible connections with people that could (hypothetically) have reasons to have planned or pay them for a s

Not difficult to guess. Most probably, looking for possible connections with people that could (hypothetically) have reasons to have planned or pay them for a sabotage act. Places visited, times, conversations, a recent biography of the owners... Is all in the phones. They may find that nothing is suspicious, and this would be in fact a valid result to include, but it will worth a try. From the point of view of the phone owners, a problem is how to guarantee that the phones are not contaminated with fake data later. I assume that there are official protocols deployed to keep the chain of custody safe and clean.