Also temporally separated. That is you must have backup that is beyond attackers time horizon. This is only way to get back at least something.
This scenario happens often (as far as I know) with ransomare attacks (on personal devices): Encrypt least used documents first. Probably noone will realize it over weeks that data "is gone".