I would begin in 2 "places" you could say. I would first try to see if there had been any prior threats or attempts to attack any of these sites before in a major way. The twin towers had been attacked in 1993, or one of them by using a major truckbomb that blew a several stories deep hole in one of the towers. Had the truck been parked close to the "right" column, it would have brought the tower down according to some video I saw once, but can't recall which one it was now.
CNN has link with fast facts about the 1993 bombing in which they among other things write this:
"Ramzi Yousef directed the organization and execution of the bombing. He said he did it to avenge the sufferings Palestinian people had endured at the hands of U.S.-aided Israel."Ramzi Yousef happens to be the nephew of Khalid Sheikh Mohammed, the suspected (and admitted - before arrest too) mastermind of 9/11. We (those of us who have read the alleged motivation behind 9/11) can also notice that Ramzi's supposed motivation for attacking the WTC is similar to KSM's and Osama's 8 years later in 2001.
When Khalid Sheikh Mohammed was arrested, you could see this connection. It "fits". and, K.S.M. is of course AQ and admitted his guilt to an Al Jazeera-reporter together with Ramzi Bin al-Shibh in Pakistan prior to arrest and waterboarding. They even said to the reporter that he would make a great suicide bomber! The assumption is that that's a great compliment in their views... They called it "the planes operation". The reporter almost thought they may have exaggerated a bit, but it's unclear exactly what they said was true and what was not. Bin al-Shibh wanted to go to USA and be part of the 9/11 attacks, but was refused a visa so he couldn't. Instead he helped sending money via wire transfers to hijackers, discussing targets with Atta and Osama and other things.
Going back to where I would look for those responsible... The 2nd "place" I would go to would be the crime scenes. Which are the crime scenes here on 9/11? One can think in at least 2 different ways. They could be the air planes as it was there that the hijackings took place and it could be at the crash sites where the planes were used as weapons. I think both are correct, but I will focus on the planes.
On most planes, apart from AA77, there were several calls made, most by seat back phones that the planes had back then (has since been removed). There were also some cell phone calls, which were generally short, over rural areas and when the planes flew low, which experts as far as I've seen have said was possible. I have not heard objections (as in claiming they are fake) to the seat back phone calls.
The descriptions of the hijackers is consistent with our idea of people from AQ and some of their actions (the wielding of knives and flying the planes) is consistent with other evidence such as the 5-page note "The last night" found in Atta's luggage, them going to flight schools, practicing in flight simulators etc.. No crew or passenger as far as I know described other types of people or other types of takeover of the planes, such as gas or pressure for example. So, the eye witnesses on this(these) crime scene(s) have given testimony consistent with AQ.
I will here put out a bit of a disclaimer. I am no legal expert either, but in my view, both the calls and the admissions of KSM and Bin al-Shibh are circumstantial evidences as the admissions could be lies and there is a theoretical chance that calls were fake or not true, even if I don't doubt the calls at all or think the admissions on the whole are fake (some of what they said may have been false though). Even so, if we assume I am correct that these are circumstantial pieces of evidences they all point towards AQ as perpetrators.
The document "the last night", receipts of maps for airplanes, mace and other things they bought and audio both of people on the planes, including the hijackers, are real exhibits, and are in fact online at the prosecutor's part of the Moussaoui-trial's website.
The crash sites were either seen by witnesses, pictured, videotaped, shown live or proven by physical evidence such as plane parts (black boxes for example) showing that planes were indeed used (for those doubting that). In 2 of the sites (NYC and Pennsylvania) some parts of identification of some of the hijackers were found, again linking to AQ (given that we knew these were AQ). Also, flight manifests helps here to connect it to AQ.
Hence, I would not go by "who benefits" to find the perpetrator(s). Alex Jones benefitted for example. Doubt that he did 9/11 though. Even if he "predicted" it prior...