Files were renamed with the .locked extension. Incident notes: isolate host before recovery.
