VPNs don't work if they've already got your IP... Changing MAC address has no effect on some (mainstream companies) routers. My recommendation is to tell your friend there to call his ISP and find the logs of DDoS. They may be able to file a report on the DDoSer to his ISP. However, that's very unlikely that that'll happen. If he's using a paid booter to DoS/DDoS they'll never get the true IP.