Ransomware Encryption
Ransomware encryption is different from losing the password to your own encrypted volume. Depending on the ransomware family, keys may be generated locally or remotely, reused, exposed by an implementation flaw, or unavailable without the attacker; incident containment and precise identification come before assumptions about decryptability.
What's actually happening
Ransomware may encrypt selected files, accessible shares, backups or larger portions of a system using family-specific key handling, then leave a ransom note. Some variants overwrite files in place; others create encrypted copies and delete originals; behavior varies enough that recovery options cannot be inferred from the ransom note alone. Some ransomware families have implementation flaws that researchers have already broken, meaning a free decryptor already exists for that specific strain; more recent, well-built ransomware generally doesn't have a known weakness.
How recoverable this really is
Varies enormously by which specific ransomware strain is involved, which is exactly why identifying it precisely — rather than assuming the situation is hopeless, or assuming it's easily fixable — is the real first step. Some well-known older strains have free public decryptors; well-implemented current ones generally don't. Beyond the ransomware's own flaws or lack of them, the other realistic path is whatever backups existed before the attack and weren't reachable by it, and in some cases forensic recovery of remnants of the original files if the ransomware deleted rather than overwrote them, similar in principle to the accidental deletion scenario, though this varies by ransomware family.
The general approach
Isolate the affected system from any network immediately to stop further spread, identify the specific ransomware family from the ransom note or the file extension it appended (projects like "No More Ransom" maintain identification tools and known decryptors), and check for backups untouched by the attack before considering anything else.
Don't pay the ransom as a first move, and don't reinstall the operating system or reformat the affected drives before an expert has looked at what's there. Paying doesn't guarantee a working key even when the attacker is willing to provide one, and a clean reinstall destroys exactly the remnants — deleted originals, ransomware artifacts needed for identification — that a real recovery attempt would need intact.
A backup that's genuinely offline or offsite when the infection hits — not just a second folder on the same network — is the most reliable defense against this scenario specifically, since ransomware that can reach a connected drive will generally encrypt that too. See Backup Drive Picks.
This page describes the general situation, not a guaranteed fix for your specific case. If you'd rather have someone experienced take a look before you try anything, see what a hands-on evaluation looks like.