ESXi VM Encrypted with No Snapshot: Don't Touch the Original Storage—Assess What's Recoverable in This Order
When an ESXi VM is encrypted by ransomware with no snapshot or usable backup, first stop all writes to the datastore, then determine whether the VM config files or the underlying -flat.vmdk data disks are damaged.
