You see your son/daughter upset at 5:30 PM.
Suppose logs show your son/daughter was accessing IPs associated with Facebook/Messenger at 5:28 PM.
One could reasonably infer that something/someone upset them.