I second @apogio's questions.

But your expectations from the crypto forensic team are probably too high. Cryptocurrencies normally are very unlikely to be "returned" if a hacker had access to your private key and was able to transfer the cryptos to another address. Most what they can do is to help the police to investigate.

The most likely case is that one of the devices where you accessed the Metamask account from was infected by malware. While Metamask is not totally decentralized, its wallet is self-custodial afaik, so you are responsible yourself to take care of the keys and the passphrase.

Edit: this deserves a comment:

One of the "points" of cryptocurrency is just that it's a way to transfer values without middlemen. You stored your cryptocurrencies on a self-custodial wallet (Metamask), so you followed this principle. However, I guess you misunderstood Metamask to be some kind of "bank" which has control over your coins. This is not the case, they have no control over your keys and afaik they don't store a backup (like some other services do).

It is of course possible that Metamask distributed a version with a vulnerability which was exploited by the hacker. Then they could have some responsibility. Malware would still be necessary to exploit that, so very likely even in this case one of your devices has been compromised.