I am wondering if ransomware can encrypt currently opened/locked files by an application?
Example: Some application opens files and lock them for manipulation e.g. Database. So I assume that when the system gets infected by ransomware, but database file is already in use, it can't be encrypted until database engine closes all handles to it. Only then, the ransomware can encrypt the database file and during its stealth operations decrypt it when file is again used by the database engine. For the database redologs, I assume that when new log file is created, it gets encrypted by ransomware while it is still available to database engine due to ransomware operations transparency. Only when required percentage of drive is encrypted ransomware deny the file access, so database will loose access to redologs.
I am aware about techniques (example VSS) which allows to read even locked file in parallel, mainly for backup use case, but that's not for altering the file content or metadata.
My assumption is that all such files, from example above, are safe from ransomware until they keep the lock on the file and consequently also databases backups should be safe from ransomware if not done as offline backups.
Is my assumption correct, or are there any programming techniques which overrides the file handle locking mechanism? I haven't found answer on the internet, so I hope to find answer here.
Edit: My question is platform independent. Windows, MacOS, Linux and other Unix brands (e.g. AIX, Solaris...) are in the scope.