Like any problem solving process, you start as a detective…   ask preliminary questions, collect any obvious evidence, work out where you need to drill down….  build a profile of your culprit to help in the ongoing investigation.