I second @apogio's questions.

But your expectations from the crypto forensic team are probably too high. Cryptocurrencies normally are very unlikely to be "returned" if a hacker had access to your private key and was able to transfer the cryptos to another address. Most what they can do is to help the police to investigate.

The most likely case is that one of the devices where you accessed the Metamask account from was infected by malware. While Metamask is not totally decentralized, its wallet is self-custodial afaik, so you are responsible yourself to take care of the keys and the passphrase.