You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and writing a lot to the drive. You immediately do a web search for the process name, and find that it's the name of a ransomware program. A news story also comes up, telling you about how a popular software distribution site was recently compromised and used to distribute this same ransomware. You recently installed a program from that site. Clearly, the ransomware is in the process of doing its dirty work.
You have large amounts of important data on the internal drive, and no backup. There is also a substantial amount of non-important data on the drive.
This question's title says "mid" operation, but in this example we have not yet investigated how far the ransomware might have actually gotten in its "work."
We can look at two situations:
You want to preserve as much of your data as possible. However, paying any ransom is out of the question.
If possible without risk, you want to know whether the important parts of your data are actually encrypted and overwritten. You also want to try and extract as much of your data as possible without making things worse. You would hate to pay a ransom. But certain parts of the data are so important to you that you would, ultimately, as a last resort, like to still be able to pay for a chance to get them back rather than risk losing any of them.
Step by step, what is the ideal thing to do in situation 1 and 2? And why?
Note: This is hypothetical. It hasn't actually happened to me. I always keep offsite backups of my important data and I've never been affected by ransomware.