If an attack is suspected or detected in its early levels, it usually takes some time for encryption to get put rapid removal of the malware (a reasonably easy approach) in advance of it has done would cease additional damage to information, devoid.