Hacked

A friend of mine fell for the let me on your computer scam you have a virus.... So now I am trying to do damage control. Through the windows password manager it showed they had accessed approximately 93 passwords and 5 files. What I am trying to determine is if they copied any files off of the computer since there was a lot of sensitive data that was not encrypted. Everywhere I have looked it shows that there is no way of telling if a computer not on a network had files copied off of it. I have looked at different types of software but unless they were installed prior to the attack then no information can be obtained. Any advice?

Which password manager?

I too would recommend backing up data ( of course this should have been done previously) and reinstalling the OS. Removing an infection can be very difficult (even for an expert) and you can never be sure you have been fully successful. Decades ago it was said that once the security of a computer was compromised it tends to stay that way. I believe that is even more true today.

Determining if any files were copied is likely not possible. Windows has file and folder logging but it is not enabled by default. It needs to be carefully configured for your situation if it is to be both effective and not seriously impair performance. Third party software is also useful but it needs to be installed prior to the incident.

Yes, I plan on reformatting the computer. Hopefully the hackers were dumb enough just to use the tool and not smart enough to dig for sensitive data.