The basic process is to read your file contents and write them back to disk using some form of asymmetric encryption to ensure that you have to pay to get your data back. Some will encrypt only small sections of the data to improve the speed, others will rewrite your entire hard drive if they can. As some of the other answers note some malware will simply encrypt a portion of your file in-place to speed up the process, since for many file formats even a slight change in the file makes the entire file unusable.
How can ransomware like CTB-Locker or Crypt0l0cker encrypt their victims files instantly?
They can't. Instead what they do is conceal their activity by making the files appear to be OK until the process is complete. By intercepting file-system calls you can change the user's view of what is actually present on the disk, making it appear that everything is still OK until you finish, then when you take away the intercepts the user can see the true state of the drive. The danger in doing this is that you have to have both parts of your asymmetric key pair in order to decrypt the files on-the-fly when the user opens one, which in principle means that something could find the private key that you want to sell the user later.
Other malware like CryptoWall (which I've had more experience with recently than I want to remember) doesn't bother to hide, it just blazes ahead encrypting everything as quickly as it can... and that's pretty much limited by the IO speed of the drive it's encrypting to.
Looking at a few benchmarks for AES - which is the encryption algorithm that CryptoWall purports to use - a modest modern CPU can encrypt data at rates well in excess of 100MB/sec, which means that the operation is likely to be IO-bound on anything other than an SSD. Add multiple threads running on separate CPU cores targeting different folders and/or drives and the process can complete fairly quickly.
I recently had to clean up a file server that had been processed by CryptoWall running on one of the user PCs. By the time the users had noticed something was wrong the malware had been running for about 1.75 hours. We pulled the thing off the network at just shy of the 2 hour mark and during cleanup I found around 230GB of encrypted files. That's an average of ~30MB/sec encryption, which is certainly doable in the environment. It took about 3 times that long to restore the files from the previous backup. Although I have some ideas on how to speed that up next time, most clients have their backups on crappy low-cost NASs or (shudder) USB drives.
Unfortunately we are unlikely to see an end to these things any time soon. A competent, decently configured backup solution is your best friend when one of these things hits. Doesn't hurt to have a programmer handy to script the restore.