As detailed in a separate question, I thought I had a way to detect the type of ransomware that encrypts files silently, and then decrypts them on the fly, so as to prevent the user from realizing that the files have been encrypted. I thought that a comparison of present vs. past file hashes would detect file changes: if many files were unexpectedly changed, maybe those changes were due to ransomware encryption.
A comment on that question seems to say that my concept fails because a file must be read in order to be hashed. The ransomware would make the file's contents available to the hashing tool; that tool would find that the contents appeared unchanged; therefore I would get the same hash value as before.
I don't understand that. It seems I need to address it in this separate question. If hashing only takes account of the file's contents, wouldn't it be impossible to hash, say, a file that the user has securely encrypted?
A Cryptography discussion seems to say that hash values, for a file, may vary according to the timing of encryption with a public key. I interpret that as meaning that variations in the encryption process can produce variations in hash values. That seems incompatible with a general claim that hashing would not detect any difference between an encrypted file (even if decrypted on the fly) and its previously unencrypted form.
What am I missing here?