Scammed in 2017. How to see where the Bitcoin are now?

So my buddy had sent some bitcoins to one of the 2017 scams promising a compounding return. He asked me if there was a way to get them back… I tried following the transactionID but the Bitcoin were getting sent to a new address every 4 or 5 minutes, and it got too deep to keep following on the block explorers. My questions are 1) Is there a better way to follow transactions like this? & 2) If they were confiscated by law enforcement, would they be sitting somewhere waiting to be claimed if he can prove they were his originally?