The problem with the deleted data in AZ is not that the files were deleted. That's trivial - just undelete the ones that are fully intact. As to the broken files, rebuild the ldf (transaction logs) files and fix the gaps caused by the broken deleted files. That's rather mundane.
The problem is the zero length files. The actual data that is needed is the adjudication data for 11/3. Notice - those files are both deleted and zero-length. this is bad. The criminal first dropped the database, then deleted the file. When the file is undeleted, it will still be zero length.
The good news is that the database structure appears to be known, so that can be restored. The recovery team would then need to rebuild the database files. This is a very complex operation.
Probably amidst the files from November 2020 up until January 2021. I wouldn't be surprised if adjudication was performed in intervals, which would in part explain why you'd be seeing ballots coming in even after counting has been officially stopped.
A lot of the votes that came in post-counting hours could very well be coming in from batches of ongoing adjudication, leading to the spikes you see on the graphs in places like MI and WI. The numbers are still really fucking fishy, but remember, some of these states had 60% or greater adjudication rate. That's a lot of ballots being reviewed and then added to the count all at once.
I've no doubt that fraud occurred in that process, and no doubt that phantom ballots will continue to be discovered, but I think the huge late night/early morning spikes in the graphs were because of the massive numbers of adjudicated ballots all being added to the count at once.