VaultGuard Backup Features

EVERY FEATURE EARNED ITS PLACE

Built around the threats your backup software ignores.

VaultGuard Backup wasn't designed by committee. Every feature here exists because something went wrong somewhere first — silent corruption, ransomware that ate the backup folder, drives that quietly failed, "successful" backup logs that hid empty archives. Here's the full list.

If you read most backup-software feature lists, you'll see the same handful of bullets repeated across every product: "automatic backups," "cloud storage," "encryption." The bullets don't tell you anything because every product claims them.

This page is different. It tells you specifically what VaultGuard Backup does, how it works, and, more importantly, why each feature is there. If you're evaluating VaultGuard against another product, the differences are in the details below. The short version: most backup software can tell you the backup finished. VaultGuard can show you how much of your recovery has actually been proven.

Not sure what a backup should do? This guide explains what a backup is so you can understand what you are getting before buying anything.

Restore Testing and the Safety Score

The reason 3.7 exists. A backup that has never been restored is a hope, not a plan.

Automatic restore testing Before each backup runs, VaultGuard picks a sample of about fifty of your real files, favoring the kind you'd grieve over (documents, spreadsheets, photos, videos), and records exactly what each one looks like. After the backup is made and checked, it opens the backup read-only, pulls those same files back out, and compares every one to its record. A file that comes back different is a real restore failure, and you're told which file. The test runs every week as the last link of the backup chain, on a schedule, without anyone remembering to do it.

The restored files stay on your drive Every test leaves its restored copies in C:\RestoredFiles until the next test replaces them. Open one. That's the proof: not a log line that says "success," but your own spreadsheet, opened from the backup, with the right numbers in it.

A plain-language report after every test Each run writes a branded HTML report: how many files were tested, how many came back exactly right, and, if any didn't, which ones and what to do about it. Reports are kept, so you have a record of every test that ever ran. It's the document you hand an insurer or an auditor when they ask whether your backups work.

The Safety Score One number, 0 to 100, on the dashboard. It's built from proof, not activity. A backup earns a little credit for existing, more for being fingerprinted and checked, and most of all for passing a restore test; the second copy earns its own credit the same way; the last two points need a recovery drive. Every item decays as its proof ages, so a backup that passed a restore test three weeks ago is worth less than one that passed last night, and the number tells you the truth today. Below the score is a checklist of what's proven and what isn't, and one line naming the next thing to do. The rules are spelled out in plain language inside the app. The exact point values aren't published, on purpose; a score you can game isn't worth having.

It tests the copy too The second copy gets the same treatment: its own check for changes and its own restore test, on its own schedule, with its own report. A copy that has never been restored from is still just a hope.

Backup Integrity

The single most important category. If your backup tool doesn't check what it wrote, you're trusting hope.

A fingerprint of every backup The moment a backup is made, VaultGuard records a fingerprint of it (for the technically minded: a SHA-256 hash of the backup's image files, plus their count and size), tied to that exact backup version. One complete fingerprint per version, ever; a partial one is never accepted as whole.

Check for Changes Every later check compares the backup to its fingerprint. If anything in the backup has been altered, removed, or quietly corrupted since it was made, the check fails and you're shown what changed. The check runs automatically a few hours after every backup, as the second link of the chain, and you can run it by hand any time.

Checked before any restore If a backup has a fingerprint, VaultGuard checks it before restoring from it, whichever restore you use: a single file, a browse-and-pick, or the whole system. If the check fails, the restore stops before anything goes back onto your machine. If a backup has no fingerprint (a backup Windows made before you installed VaultGuard, or an older version from before the fingerprint existed), VaultGuard tells you plainly that it can't be checked and lets you decide; it never pretends.

A permanent record Every backup version gets an entry in a ledger: its identity, its fingerprint, every check and its result, every restore test and its result. The ledger is never pruned. If corruption or tampering ever shows up, the ledger is what tells you which backup it first appeared in, and it's a recoverability record you can keep for as long as your records-retention rules require.

Nothing counts unless the app saw it There's no "I tested it" button. Restore credit comes only from a restore the app performed and compared. If VaultGuard didn't watch it happen, it doesn't count toward the score.

Threat Awareness

A clean backup of an infected drive is worse than no backup at all.

Pre-backup Windows Defender scan Before each backup runs, VaultGuard asks Defender to scan the source. If an active threat is found, the backup is refused and you're told; the rest of the chain waits instead of backing up a compromised drive. Only new, active threats count; an old entry in Defender's quarantine history from last year doesn't block tonight's backup. If you run a third-party antivirus instead of Defender, VaultGuard notes that and doesn't try to run a Defender scan that isn't available.

Defender definition age check — Before the pre-backup scan runs, VaultGuard checks how recent your Defender threat definitions are. If they're out of date — say, the computer's been offline for a couple of weeks — VaultGuard updates the definitions first, then scans, and notes what it did in the log. A scan with stale definitions is a scan you can't trust, so VaultGuard doesn't run one; it fixes the definitions and runs a real one.

Two checks before any restore Modern ransomware specifically targets backup files, so VaultGuard checks the backup two different ways before putting anything back.

First, the fingerprint check. The backup's image files are compared to the fingerprint recorded when it was made. If anything has changed since, a file silently re-encrypted, modified, or removed, the check fails and the restore stops.

Second, a scan for ransomware file extensions. The Check For My Backups button on the Restore tab looks through every backup location you've set up, your main backup drive, your second copy, and a network share if you use one, for files with extensions used by known ransomware families (.encrypted, .locked, .crypt, .ryuk, and six more). If any turn up inside a backup version, that version is flagged so you know not to restore from it, and you can pick a clean one instead.

Together: the fingerprint catches any change at all; the extension scan is a fast, specific check for the most common patterns. Either one fires and the restore stops.

BitLocker status awareness VaultGuard checks the encryption status of your backup target drive. If the drive should be BitLocker-encrypted and isn't, you're warned. An unencrypted backup of sensitive data sitting on a desk is itself a security incident.

Drive And Media Health

Hardware fails. The question is whether you find out before or after it costs you data.

SMART data monitoring VaultGuard reads the Self-Monitoring, Analysis, and Reporting Technology data from your source and target drives. SMART warnings — reallocated sectors, pending sectors, increasing read error rates — are early indicators of imminent drive failure. VaultGuard surfaces them before they become catastrophic.

chkdsk integration Filesystem-level health checks are integrated into VaultGuard's scheduling. Filesystem corruption is a different category of failure than drive failure; both matter; both are checked.

Drive age tracking Old drives are likely-to-fail drives. VaultGuard tracks the age of your backup target media and warns you when a drive crosses the failure-probability threshold for its class. You'll know to budget a replacement before the failure forces one.

Available space monitoring The dashboard shows free space on the backup drive and on the copy drive, and warns you well before the next backup or copy would fail for lack of room. The copy chain also checks for room before it starts, so it never leaves a half-written copy behind.

The Second Copy

One copy is no copies. Three copies, two kinds of media, one somewhere else is the rule. VaultGuard makes the first two and proves both of them; you bring your own third.

Full system image using Windows' own engine VaultGuard uses Windows' built-in system-image tool (wbadmin) to make the backup. That means no third-party backup format that becomes unreadable when a vendor goes out of business. Your backups can be restored by Windows itself, on any Windows machine, with or without VaultGuard installed.

A second copy, versioned, never overwritten After each backup, the copy chain copies it to a destination you choose: a second external drive, a network share, or a folder that a cloud provider's desktop app syncs for you. Each copy lands in its own dated folder, so a bad copy never overwrites a good one. Before anything old is pruned, the new copy is counted and measured against the original; an incomplete copy is never counted as a backup, and you're told about it by email and in the app.

The copy is checked and restore-tested on its own The second copy gets its own fingerprint check and its own weekly restore test, on its own schedule, with its own report and its own credit on the Safety Score.

Unplugging the copy drive is rewarded, not punished A copy drive that lives in a drawer can't be encrypted by ransomware on the computer. When the copy drive isn't connected, VaultGuard keeps the copy's score credit from its last proven state and lets it age honestly, instead of dropping it to zero for doing the right thing.

If you use a sync folder, one honest caveat VaultGuard confirms the copy landed in the folder. The upload from that folder to the provider's cloud is the provider's job and your internet connection's; a large image can take days. And cloud providers cap single-file sizes (OneDrive's is 250 GB per file), so an image larger than the cap gets skipped by the sync app without much fanfare. Check your provider's limit against your image size, and if they're close, use a second drive instead.

Works with off-site mirroring tools For a third copy, layer any cloud-to-cloud sync service on top of the copy folder to mirror it to a second provider. VaultGuard doesn't manage that mirror, but its plain-folder approach plays well with any tool you choose.

Network share support Back up to a UNC path on your network, useful where a NAS or file server is the target. Windows' imaging keeps one image version per share path; the docs cover how to work with that.

Restore Options

A backup you can't restore from is not a backup. See what the restore process looks like.

Restore a file that's still on this computer For a file that's damaged, encrypted, or you just want the backup's copy of it: point at where it lives now and VaultGuard pulls that file from the backup version you choose.

The file is gone, or you don't know where it was Browse the backup like a folder tree, or search it by name, pick what you need, and restore it. The backup is opened read-only and quietly, with no drive letters appearing in Explorer.

Full system restore Reboot into Windows Recovery Environment and restore from your latest checked backup. The whole computer comes back exactly as it was at backup time. Useful after ransomware, a dead drive, or any catastrophic event.

A recovery drive, made inside the app When the computer won't start at all, you need a way back in. The Create Recovery Drive button on the Restore tab turns a USB stick into a drive that boots the machine straight into Microsoft's own System Image Recovery, built from the Windows recovery image already on your computer. Nothing is downloaded and nothing is VaultGuard's own format, so the drive works whether or not VaultGuard is still installed. Sticks under 6 GB become recovery-only; 6 GB and up get a second section you can use for files, or for your copy. The recovery files are hidden and read-only with a plain READ ME beside them, so nobody tidies them away by accident. The drive ages: the score nudges you to remake it about every six months so it matches your current Windows.

Restoring from the second copy Any single file can be restored from the copy exactly as from the backup. A full system restore from the copy works the same way: pick the copy, click Launch Windows Recovery, and VaultGuard puts the copy where Windows Recovery looks for it, then offers to put it back afterward. If Windows won't start at all, the recovery drive carries a small helper that does the same job from the recovery screen.

Checked before any restore Whichever restore you use, the fingerprint check runs first.

Security Hardening

The features you'll never see day-to-day. They're the reason VaultGuard stays trustworthy when nothing else has been touched in eighteen months.

Optional administrator passphrase, NIST SP 800-63B compliant VaultGuard offers an optional administrator passphrase that gates access to configuration changes and other administrative actions. The passphrase isn't required to use the application — it's there for users and organizations that want or need the extra layer (compliance, shared workstations, regulated industries). When set, the passphrase requirements follow the National Institute of Standards and Technology's modern password guidelines: length over complexity, no forced periodic resets, no insulting "your password must contain a lowercase letter" rules. The passphrase is hashed and stored using accepted cryptographic primitives — never in plain text.

Access-controlled runtime data VaultGuard's configuration, state, ledgers and logs live in C:\ProgramData\VaultGuard\Backup\ with an access control list that grants access only to administrators and to VaultGuard itself. Standard user accounts on the same machine cannot read or modify them.

The settings can't be changed behind your back VaultGuard keeps a fingerprint of its own settings. Every time it starts, it checks the settings against that fingerprint. If something changed them while VaultGuard wasn't running, whether malware, another person on the computer, or a well-meaning "fix," you're told before anything runs. VaultGuard keeps a known-good copy of the settings for exactly this moment, so you can put them back with one click and keep your passphrase, schedule and backup destinations without typing any of it again. A separate check catches settings that are simply broken, like a drive letter that no longer exists or a schedule with no days, and says so in plain words.

Session timeout Administrative sessions time out automatically after a configurable period of inactivity (default 10 minutes). Walk away from your computer and the next person can't change your backup configuration.

Failed-attempt lockout — Five failed passphrase attempts lock passphrase entry for 15 minutes. Closing and reopening the app doesn't reset the counter or bypass the lockout — both survive restarts. When a lockout triggers, an alert email goes to your configured address even if you've turned other alerts off, because you should always know when someone is guessing at your passphrase. And if that someone is you and you've genuinely forgotten it, passphrase recovery by email stays available during the lockout — and the recovery path has its own limits (three attempts per hour, three wrong codes and the session ends), so the escape hatch can't be used to guess around the lock.

Code-signed binary Every VaultGuard release is digitally signed by Information Security Kentucky LLC. Windows verifies the signature on install and every update. If a binary claiming to be VaultGuard isn't signed by us, Windows will tell you.

Hardware-bound licensing Your subscription is tied to your specific computer's hardware. Casually sharing a license key with another machine doesn't work. Need to move to a new computer? Email customer service and I'll re-bind your license. On the Technician edition, the master computer can deactivate a machine's seat itself and free it for the next one.

When a license lapses, nothing is deleted If a subscription expires, the app doesn't wipe anything, doesn't lock your backups, and doesn't stop you restoring from them. New backups pause, you get a short grace period to renew, and renewing puts everything back with one click. An offline computer gets seven days before it needs to check in.

Operations

The boring stuff. Doing this well is what separates real backup software from consumer toys.

A dashboard that tells the truth Nine scheduled tasks, each with its own card: Backup, Fingerprint, Check Backup for Changes, Backup Restore Test, Copy, Check Copy for Changes, Copy Restore Test, plus the daily age check and the configuration check. Every card shows the same thing whether the task ran on its schedule or you clicked it yourself: running, waiting its turn, ready with its last success, failed, skipped, or pending because a newer backup hasn't been checked yet. If the drive is connected and there's no backup on it, the card says so in red instead of showing last week's green.

No silent failures When a scheduled task fails, you get an email in plain words: which task, what went wrong, what it means, what to do, and which steps behind it are waiting. If an earlier backup is still good, the email says so, so a failed check doesn't read like a lost backup. Tasks run through a managed relay; you don't configure SMTP. One honest note: the email subject and body pass through my infrastructure on the way to your inbox; the contents of your backups never leave your computer. Details are in the Privacy Policy.You won't get an email when things go right. Silence from VaultGuard means every scheduled task did its job; an email means something needs you. That's deliberate, so the one email that matters never gets lost in forty that don't.

Chains that stop instead of pretending The backup chain runs in order: backup, fingerprint, check, restore test. The copy chain runs copy, check, restore test. If a link fails, the links behind it wait and say so; they never run against a backup that didn't pass.

Manual equals scheduled Every step can be run by hand from the dashboard, alone or as a chain, and it uses exactly the same engine the scheduled run uses. There is no separate "manual mode" with different behavior.

Task Scheduler integration The tasks are ordinary Windows Task Scheduler entries: visible, manageable with standard Windows tools, and they survive reboots. If the computer was off at the scheduled time, the chain runs when it comes back, still in order.

Laptops Every task runs on battery and survives unplugging. The computer wakes for its schedule, laptop or desktop.

Getting Started The first launch opens a five-step page: pick the backup drive, pick the days and time, make a recovery drive, save, run the first chain. It uses the same controls you'll find later on the Configure and Schedule tabs, so nothing has to be learned twice.

Technician tab (Technician edition) One screen for every computer you look after: each machine's Safety Score, worst first, updated daily, with seat management from the master computer.

Machine and client identity fields Set a machine name and a client name. They appear in emails, logs and reports, which matters when you run VaultGuard across several sites or for clients.

Cleanup tools Keep the number of backup versions and copy versions you choose; older ones are pruned only after the newest is confirmed complete. Delete old versions by hand when you need the space.

Detailed logging Every backup, restore, check, configuration change and security event is logged locally in C:\ProgramData\VaultGuard\Backup. Logs are useful for troubleshooting and required for any investigation if something goes wrong.

What It Runs On

• Operating system: Windows 11 recommended. Windows 10 (version 1909 or later) still works, but no longer receives security updates from Microsoft.

• Architecture: 64-bit only

• Disk space: ~100 MB for the application

• Backup target: External USB drive, internal drive, or accessible network share

• Second copy (optional but recommended): a second external drive, a network share, or any cloud storage provider's Windows desktop sync app. The choice is yours.

• Off-site mirror (optional, separate from VaultGuard): Any cloud-to-cloud sync service of your choice, configured by you

• Network: Required for license validation (seven-day grace period if offline) and for failure emails. Not required for backups, checks, restore tests or restores.

What VaultGuard Backup Does NOT Do

Honest about the limits.

• It is not antivirus software. VaultGuard scans with Defender as part of backup operations, but it doesn't replace a real antivirus product running continuously. Use Defender or a third-party AV alongside VaultGuard.

• It does not back up Mac or Linux machines. Windows only, for now.

• It does not provide cloud storage itself. You bring your own cloud storage account from whichever provider you prefer (and optionally a second account at a different provider for off-site mirroring). VaultGuard moves data into those accounts; we don't host data ourselves.

• It does not replace a managed-IT relationship. For Kentucky small businesses that want hands-on setup, monitoring, and support, that's what Information Security Kentucky's services are for.

• It does not guarantee against data loss. No backup software can. VaultGuard is engineered to make data loss as unlikely as possible and recovery as reliable as possible — but you are still responsible for testing your backups, maintaining redundant copies, and following the 3-2-1 rule.

• It does not encrypt the backup itself. The backup is a standard Windows system image, readable by Windows. If the drive it lives on should be encrypted, turn on BitLocker for that drive; VaultGuard warns you when it isn't. Built-in encryption of the image is on the roadmap, and it will ship when it's right, not before.

• It does not run continuously. Backups, checks and restore tests run on the schedule you set, not every few minutes. If you need a file from ten minutes ago, that's what the second copy and Windows' own previous-versions are for.

See for yourself.

A 14-day free trial gives you full feature access, no credit card required to start. Configure VaultGuard against your real environment, run a backup, run a restore, and decide whether the engineering matches the description.