How to tell ransomware is encrypting your files

The early signs, in the order they usually appear

Encryption is loud if you know what to listen for. Before anything is announced, the machine does a set of things that are unusual on their own and damning together.

One of these alone can have an innocent explanation. A backup program touches many files. An installer runs an encoded command. Two or three of them within the same minute do not have an innocent explanation.

• Shadow copies and the backup catalogue are deleted — this is the step that removes your way back.
• The disk works hard with no program open that would explain it.
• Files keep their names but no longer open, or gain an extension you have never seen.
• A text file appears in several folders at once with the same name.
• BitLocker suddenly wants to encrypt a drive you did not ask it to encrypt.

Why a file that is encrypted stops looking like itself

Almost every file format starts with a fixed signature — a Word document begins with PK, a PDF with %PDF, a PNG with its own eight bytes. Encryption replaces the whole file, so that signature goes with it.

There is a second measurement that pairs with it. Randomness in a file can be scored, and ordinary content scores low: plain prose sits around 4.2 bits per byte, and already-compressed formats like JPEG or ZIP sit between 5 and 7. Encrypted data sits above 7.5, because that is what encryption is for. Neither measure means much on its own — a ZIP is legitimately high, and a broken file is legitimately headerless. A file that has lost its signature and gained randomness has been rewritten.

What to do in the first minute

Order matters more than speed here, and the instinct most people have — start opening files to see how bad it is — is the wrong one.

Do not pay before talking to someone who has handled a case. Do not reinstall Windows over the disk: it destroys the evidence and sometimes the only copy of the key material.

• Disconnect the network — cable out, Wi-Fi off. Shared drives are how one machine becomes ten.
• Do not reboot. Some keys live only in memory, and a restart throws them away.
• Photograph the ransom note and the extension with your phone; identification depends on both.
• Leave the encrypted files where they are. Free decryptors exist for some families, and they need the originals.

What a user-mode program can honestly do about it

This is where most security marketing stops being true, so here is the limit stated plainly. A program without a kernel driver cannot stand between another program and the disk. It cannot be a wall. What it can be is a tripwire and a witness.

Rain Cleaner writes decoy files into the folders that matter — three per folder, named so that one of them sits near the front of any alphabetical listing, one in the middle and one at the end, because a program encrypting a folder walks it in order. It scores what it sees on a scale where a suspicious command shape can raise an alarm but only a completed act — shadow copies deleted, a decoy rewritten, a security service killed — can stop a program. And it writes a journal where each line carries the hash of the line before it, so that a deleted line becomes a visible hole instead of a clean escape.

The BitLocker variant nobody expects

Some attacks bring no encryption of their own. They turn on BitLocker with a key you never see, remove yours, and leave. Your data is encrypted with a Microsoft feature that is working exactly as designed.

Windows records this: event 773 when a protector is suspended and 776 when one is removed. If BitLocker was never something you set up, either of those in your event log is worth an immediate look.