You won't find anything like articles, categories and menus in file manager. You should be able to find the Joomla installation folders and files, including all extensions and media/images files.
Actually what you need to do is to download all these files, plus the database of your site.
Assuming the intruder didn't damage anything crucial in your installation, you should be able to restore your site in your localhost (or other hosting environment) - and then perform all required updates and other security enhancements and finally re-upload your site online.
To restore the site all you need is the original folders/files of the Joomla site instance and the database. You connect the Joomla installation files to the database, through the configuration.php file - it holds variables for the database connection.
These are the configuration variables (with sample string values), referring to the database connection:
public $dbtype = 'mysqli';
public $host = 'localhost';
public $user = 'db_user';
public $password = 'db_user_password';
public $db = 'db_name';
public $dbprefix = 'prefix_';