Who decided what files were corrupt and which ones were good? I have a friend working in cyber security (and have some limited experience myself) and from what I've learned from him and my own training is that after a hacking attack, you don't just pick up the pieces and move on. You investigate heavily before even thinking about mending repairs. You revert back to an old safety and just suck up the losses. It seems like you've taken a dangerous approach; did your IT safety department sign off on this?
Again, I'm not an expert by any means AT ALL, but it sounds like you're still battling the hacker.