Heyyyyyyy ...DONT format. Keep the evidence !!!
Why ? ... police can help ?
No ... because is not money ...
It is required to keep so that he may take help of some cyber expert to find out the IP trace of the attacker. Probably the anti-virus software running on his machine already has it.