Ransomware Basics
What does ransomware do to an endpoint device?
On an endpoint, ransomware typically executes a payload that enumerates files, encrypts documents and databases, deletes local backups and volume shadow copies to prevent easy recovery, and displays a ransom note. It may also disable security software and establish persistence to survive reboots.
The endpoint is where execution is visible, but the lasting damage is to the data — including data synced or backed up to other systems. Elastio inspects that data wherever it lives to determine what is actually recoverable after the endpoint is rebuilt.
Last updated
Related terms
Prove your recovery
See the evidence behind the decision.
Pursuit investigates compromise and guides response. Hunt provides evidence to assess recovery candidates.