Re: "detecting infections and reverting unexpected encryption"
Duh. Its you thats not thinking it through. If the solution is in firmware the Trim command is also subject to interception and nulling/modification by this solution. Trim becomes "Trim everything except 1 known good copy".