Iran, in this circumstance, will probably not hand over the boxes and are already claiming the boxes were "damaged". They cannot hand the boxes over for analysis. What a mess. Feel awful for the passengers and crew. Half the plane was Iranians and the rest Canadians and Ukrainians. The system suspected is the TOR https://en.wikipedia.org/wiki/Tor_missile_system The thing is, the TOR has IFF capability, it is supposed to actively interrogate IFF systems to prevent this exact scenario. It shouldn't shoot a civilian airliner if operated correctly.
I believe it to be extremely ironic that a Russian made missile, fired by Iran, took down a Ukranian airliner.
The airline is not without liability as well, at least if it were an American airline. The FAA had banned all American airlines from Iran WELL BEFORE any action had begun- for obvious reasons. And even though the Ukrainian airline is not bound by the FAA, they are responsible for "situational awareness" - ie. what the fuck are you doing there is a war going on. Fortunately, I know little about Ukrainian law and plan on keeping it that way. Just saying that airlines and regulators have responsibilities too in these messy situations and fortunately the Americans took care of business there. Not sure what Iran thinks the outcome is going to be by withholding black boxes and not using its own awareness to shut down flight operations in advance. They will wake up and find that Bolivian Airlines is the only carrier willing to fly in and out. Not good for the economy.
The liability thing is why the Iranians will not release the flight recorders. Obviously the air defense systems around Tehran were active and twitchy just after their missile attack on Iraqi bases. It seems like an accident. They allowed commercial flight operations because they likely thought their air defenses would not do this. Either the IFF squawk of this aircraft got erroneously flagged as a bomber or the Tor had its IFF overridden by mistake. It is also possible that the aircraft IFF did not respond properly or at all to interrogation by the air defense system. Maybe it got overwhelmed responding to lots of interrogations from different elements of the system. They (somebody) found a piece of a Tor missile at the crash site. Not conclusive but it makes it very likely.