Encryption Rollback ? how it works?

Hi MrParham
 
This all relates to WSA putting a file or app into a 'Monitored' state.
 
If WSA put them into 'Monitored' status (as it could not determine if they are good or bad) then later it will move them from that status to either 'Blocked' (as bad), and will initiate reversal of any actions performed whilst monitored or 'Allow' (as good) as soon as its determination in the Cloud has been completed.
 
So in the case of encryption it will monitor what is encrypted and when the ransomware is finally identified as such then WSA will look to roll back its activity.
 
This previous post may help understand what 'monitoring' is, in more detail.
 
The user can also move an automatically monitored file/app at any time if they believe that the file is good or bad in which case the journal files associated with the monitoring are not removed (I believe) or a user can set a file/app to monitor if they are suspicious of its intentions (same outcome re. the journal files produced, as previous stated).
 
Finally, please see this KB Article on what happens if WSA 'misses' a virus or malware. That should further help explain the feature.
 
Hope that helps?
 
Regards, Baldrick