Use 360文档卫士 to monitor file modification operations.

Tool name: 360文档卫士

Download link:  http://weishi.360.cn/wendangweishi.html  

Function: Before and after program deployment and installation, or after cleaning malicious code from programs, add the required file extensions to be monitored, so as to monitor modifications to files with the corresponding extensions. Use it together with other security protection software, such as 云锁 (help.yunsuo.com.cn) or 火绒 (https://www.huorong.cn/).

How to use:

After downloading and installing, refer to the following screenshots for instructions:

Effect:

As shown in the figure below, at 17:00 on March 11, 2020, an x.php file was created and content was written to it. 文档卫士 immediately monitored the operation and recorded the modification time. At 9:00 AM on March 12, the file was modified again, and 文档卫士 was able to record the latest modification time again.

If you need to restore the data from the 11th, refer to the figure below:

After clicking restore, go to "Restore location" to view the restored files; see the attached figure for details: