Between the CVR, FDR, and physical wreckage they will know exactly what happened.
If they were moved to cutoff due to some sort of failure it will be obvious to the investigators. Or if it was indeed sabotage, or just human error.
Those switches are 100% manual only.