Well, depending on your server's file system and underlying hardware, getting the deleted files restored would be either difficult or extremely difficult to borderline impossible, at least with a sane amount of cost.
Regular backups are always heartily recommended.
As to how they did it, you'd have to inspect the logs and study the original code of the site.