I recall seeing some signature evidence of SAM detonation on A/C Parts from a previous conflict, which made it pretty easy to determine the system in use. Although I'm not familiar with the alleged system in this case, as F3WMB pointed out, you wont really need a black box for this one, if indeed a SAM was used.
Also, responding to the potential for cockpit evidence, IIRC the KAL shootdown was by an air launched missile, which required multiple launches to bring down the A/C due to the size of the target. Ground based systems don't normally have the same warhead/size constraints of their air launched compatriots.