The nice thing about technology is the crafty code we can build into devices to tell us the state of things at any given time.
In IT, I routinely monitor applications I’ve written via alerts I’ve built into the applications to alert me when trouble is brewing. When these alerts come in, I then investigate the errors in the alerts as well as log files on servers for reasons as to why abnormalities occurred. These simple investigations of mine, in a small IT shop, are quick. The investigations usually consist of only a few hours of sifting through log files, reviewing alert error messages and discussing symptoms with users and in the end we have determined the issue and have implemented measures to prevent the issue from occurring in the future. However, with a large IT shop and lots of log files, these investigations can take a seriously long time just due to the massive amount of data that needs to be carefully reviewed (line by line).
During large-scale investigations, theories of what has taken place may change moment to moment based on the data being reviewed at that moment and the number of specialist called into the investigation. It is only when all data has been carefully reviewed that a solid statement of what is believed to have occurred can be made. I’m sure there is a massive amount of data that has to be reviewed in the case of a plane disappearing, everything from log files of data coming from the plane to satellite imagery. I am confident the investigators, no matter what country they are in, will eventually come to a sound conclusion once all data is reviewed. Until then, with great sadness, we can only exercise patience and avoid making quick decisions based on fear, speculation or intense sorrow.