detection

The signals that appear hours or days before encryption starts — and how to catch them.