By the time there is a ransom note on the desktop, the work is finished. The useful signs come earlier, and most of them are visible without any special tool.
Encryption is loud if you know what to listen for. Before anything is announced, the machine does a set of things that are unusual on their own and damning together.
One of these alone can have an innocent explanation. A backup program touches many files. An installer runs an encoded command. Two or three of them within the same minute do not have an innocent explanation.
Almost every file format starts with a fixed signature — a Word document begins with PK, a PDF with %PDF, a PNG with its own eight bytes. Encryption replaces the whole file, so that signature goes with it.
There is a second measurement that pairs with it. Randomness in a file can be scored, and ordinary content scores low: plain prose sits around 4.2 bits per byte, and already-compressed formats like JPEG or ZIP sit between 5 and 7. Encrypted data sits above 7.5, because that is what encryption is for. Neither measure means much on its own — a ZIP is legitimately high, and a broken file is legitimately headerless. A file that has lost its signature and gained randomness has been rewritten.
Order matters more than speed here, and the instinct most people have — start opening files to see how bad it is — is the wrong one.
Do not pay before talking to someone who has handled a case. Do not reinstall Windows over the disk: it destroys the evidence and sometimes the only copy of the key material.
This is where most security marketing stops being true, so here is the limit stated plainly. A program without a kernel driver cannot stand between another program and the disk. It cannot be a wall. What it can be is a tripwire and a witness.
Rain Cleaner writes decoy files into the folders that matter — three per folder, named so that one of them sits near the front of any alphabetical listing, one in the middle and one at the end, because a program encrypting a folder walks it in order. It scores what it sees on a scale where a suspicious command shape can raise an alarm but only a completed act — shadow copies deleted, a decoy rewritten, a security service killed — can stop a program. And it writes a journal where each line carries the hash of the line before it, so that a deleted line becomes a visible hole instead of a clean escape.
Some attacks bring no encryption of their own. They turn on BitLocker with a key you never see, remove yours, and leave. Your data is encrypted with a Microsoft feature that is working exactly as designed.
Windows records this: event 773 when a protector is suspended and 776 when one is removed. If BitLocker was never something you set up, either of those in your event log is worth an immediate look.
Last updated: 2026-08-28
Often, and it should be your first line. But the families that actually make the news in 2026 are the ones that arrive carrying a signed but vulnerable driver specifically to switch the antivirus off from underneath. That is why a second, independent witness has value.
For an attacker who knows the exact names, yes. That is why placement matters more than secrecy: a program that walks a folder in order meets a decoy among the first files it touches, whatever it intends.
Sometimes. Check whether shadow copies survived, check the No More Ransom project for a decryptor for that family, and check any backup that was not mounted at the time. Keep the encrypted files either way.
The safe order — Windows Update, then the manufacturer, never a driver pack.
Category by category — what you get back, and what you quietly give up.
What “free” should mean, and how to check a cleaner before installing it.
Free, no account, no subscription. Windows 10 and 11.