There are two ways to move the coins from the suspect’s wallet into the newly created multisignature address. The first was using the Electrum from the multisignature wallet, select Wallet/Private Keys/Sweep, and from that window, you can enter the private key or keys of the suspect. All of the funds managed by the suspect will now be moved to the new multisignature address.
It is important to remember to acquire a raw private key from the suspect or by dumping his wallet. A different approach would be necessary if you have a recovery seed. Although you can still use the Electrum software to set up a wallet recovery, it is important to keep the wallet separate for keeping the evidence separate to avoid any contamination or chain of custody issues or assigning coins to the wrong investigation.
All of the evidence must be well preserved. It should be noted that any transaction on Bitcoin can take a while to complete. If you are doing the cash out on the suspect’s computer, you must wait until at least one block before leaving. Each block can take around 10 minutes to complete, and the fee will control the next block the transaction is included in.
The fee slider bar determines how much to pay and allows transactions for blocks to be included in.
If the assets are returned, a fee can be incurred to pay back the suspect.