What does ransomware do to an endpoint device?

On an endpoint, ransomware typically executes a payload that enumerates files, encrypts documents and databases, deletes local backups and volume shadow copies to prevent easy recovery, and displays a ransom note. It may also disable security software and establish persistence to survive reboots.

The endpoint is where execution is visible, but the lasting damage is to the data — including data synced or backed up to other systems. Elastio inspects that data wherever it lives to determine what is actually recoverable after the endpoint is rebuilt.