Not necessarily. From the article: The encryption process ensues over days, weeks, or months, normally progressing through hard drives, attached drives, and n

Not necessarily. From the article: The encryption process ensues over days, weeks, or months, normally progressing through hard drives, attached drives, and network devices. The C&C server decrypts files as they are needed. Along the way, crooks place a ransom note in every folder that has encrypted files; they might also plant other types of malware on systems. During the final stage of an attack, the ransomware uninstalls itself, the thieves remove the encryption key from the infected system and the victim sees a ransom note on the computer screen. If the encryption goes on over a long enough period, recovery would be a nightmare or even impossible, especially if the tape rotation period is exceeded.