Presumably it's doing something like encrypting just the file headers or a part of the file, that way it can "lock" more files in a shorter time. JPEGs seem to be quite robust in being partly recoverable even when parts of a deleted file have been over-written - sorry I don't know the details.