The only recoverable answer to ransomware is a backup solution that is configure to not allow network users access. Typically we setup both a local and offsite for disaster recovery. Snapshots should be taken as often as the system will allow to reduce the data loss...there will be data loss, just how much depends on the snapshot interval.  You need todecide what your recovery time needs to be, typically we do 1 hours unless the hardware wont allow it because it out dated.  FIrewalls, antivirus, user education are all good but will not protect your data.  What's your data worth, the terrorist will set the terms so be prepared.  I have seen them ask for $100 to $40k, would you survive?