What changed, when, and why.
RELEASE NOTES
EVERY VERSION, EVERY CHANGE
I'd rather over-document than leave you guessing what your backup software does. Each release lists every fix and every meaningful new feature. Customer-facing security fixes are called out separately so you know when an update is more than optional.
How VaultGuard Versions Work
VaultGuard follows semantic versioning: major.minor.patch.
Major (e.g., 3.x.x → 4.0.0) — significant architectural changes or breaking changes to configuration. Read the upgrade notes carefully before installing.
Minor (e.g., 3.2.x → 3.3.0) — new features that don't break anything existing. Safe to install.
Patch (e.g., 3.2.0 → 3.2.1) — bug fixes and security updates only. Always safe to install. Always recommended.
I commit to publishing security patches as quickly as I reasonably can after a confirmed vulnerability — typically within a few business days.
Going forward, every public release will be retained and available to active subscribers. Older versions of VaultGuard predating the v3.2.0 public launch were not retained — only the current release exists today.
How To Read These Notes
Every release entry uses the same structure:
New — features added in this release
Improved — refinements to existing features
Fixed — bug fixes
Security (only when customer-facing) — security issues that affect users directly
A release entry might not include all four sections — only the ones with actual changes appear.
Releases
VaultGuard Backup v3.6.0 (CURRENT)
New
Failure notices that actually tell you what happened. When a scheduled backup, copy, verification, or integrity check can't finish, VaultGuard now sends a plain-language notice explaining exactly what went wrong and what to do about it — instead of leaving you to piece it together from the logs. If something fails, you'll know, and you'll know why.
Versioned backup copies. Each backup copy now lands in its own dated folder on your copy destination, so a newer copy can never overwrite an older good one. If a later copy is ever incomplete or compromised, your earlier clean copies are still there, untouched.
Improved
Long backup copies no longer appear stuck. A large copy that runs for several hours now keeps the interface responsive and updates correctly the moment it finishes, instead of looking like it's still running long after it's done. If a copy runs unusually long, VaultGuard unlocks the buttons so you can keep working, while clearly noting the copy is still finishing in the background.
Clearer status while a backup runs. The status indicator now follows the actual stage of a long backup — showing "Saving Fingerprint" during the integrity fingerprint step and "Copying Backup" during the copy — rather than resting on "Backing Up" the whole time.
Your dashboard's "Last Verified" and "Integrity Status" now always agree. The verification date and the integrity result are drawn from the same record and are color-matched, so they read as one clear statement about your most recent check rather than two figures that could drift apart.
Windows edition awareness. On editions of Windows that don't include drive encryption, VaultGuard no longer prompts you about it — the reminders only appear where the feature is actually available.
Fixed
Backup retention now correctly keeps only the number of versions you set. A cleanup step could report success while actually removing nothing, letting old backups accumulate past your chosen limit and fill the drive. Retention now reliably prunes to your configured number of versions.
"Last Verified" no longer overstates what happened. Confirming that a backup is present is not the same as verifying its integrity, and the dashboard could previously show a verification date after only a presence check. The verified date now updates only after a genuine integrity verification.
Interrupted backup copies are cleaned up automatically. If a copy fails partway through — for example, if the destination drive disconnects mid-copy — the incomplete folder is now removed so it can never be mistaken for a good backup, and the details of what didn't copy are recorded in the log. Your previous complete copies are left untouched.
A single copy failure now sends a single notice. Certain copy failures could generate two emails for the same event; you now receive one clear notice per failure.
Leftover empty log files are cleaned up. Windows leaves behind small placeholder log files after each backup that could accumulate over time; VaultGuard now clears the truly empty ones while always keeping any log that contains a real message.
License tier is now identified correctly. Some licenses could display as a different tier than purchased, which in turn could hide tier-specific features. Your license tier is now read directly from its source and displayed accurately.
Security
Configuration is protected against tampering. Your administrative settings — including your PIN — are now stored in a way that detects and resists unauthorized changes, so someone can't quietly alter how VaultGuard protects you.
Download: [VaultGuardBackup_v3.6.0.exe] SHA-256: BC06535BCA600976034E547929750242DCCCFF8A3727B0F1AC2F8641A5EDB6EB
VaultGuard Backup v3.5.0 (July 13, 2026)
New
The Dashboard now includes a Restore Details panel showing, at a glance, how many restore points you can actually recover from your drive and the date of your most recent one. This is the number that matters — the restore points genuinely available on your connected drive, not older entries Windows may still list internally after their underlying data has rotated off.
Improved
The Dashboard has been reorganized so related information sits together. Your most recent verification date now appears directly beside your integrity status, so "when it was last checked" and "what the check found" read naturally side by side.
Dashboard status now updates immediately after you run an Integrity Check, Verification, or Cleanup from within the app — no need to reopen VaultGuard to see the current state. What you see always reflects what actually happened.
Fixed
The Cleanup Old backups list displayed backups in no meaningful order, making it hard to tell which were oldest. Backups now list newest-first, so you can see at a glance what you have and what you're removing.
The Dashboard integrity indicator could continue showing "Verification Pending" after a manual verification had already completed successfully. The indicator now reflects the true, current state as soon as the check finishes.
Download: [VaultGuardBackup_v3.5.0.exe] SHA-256: 3B03647652123E0D133CDFFB94A6B0E5AD2BA40D4C3228B6DFD65B5D40C9A912
VaultGuard Backup v3.4.1 (July 7, 2026)
Fixed
Scheduled Backup Verification and post-backup Integrity Check could silently fail on some installs. Task Scheduler recorded the tasks as completed, but no verification or integrity check actually ran — leaving the Dashboard showing "Verification Pending" and preventing the next Verify from having a stored code to compare against. Both tasks now run reliably every scheduled cycle.
All six background tasks (Backup, Cloud Copy, Config Integrity, Post-Backup Integrity, Verification, Age Check) have been restructured to eliminate this class of failure entirely. Any task can now grow in complexity without risk of hitting the underlying Windows limit that caused the original bug.
Restore tab could show "Unknown status" for backup versions that had been successfully verified. Verification status now displays correctly in all cases.
Security
Backup verification was silently skipping on affected installs, which meant the integrity-check-then-verify safety chain wasn't actually running. With this fix, the verification step reliably runs and either confirms your backup is unmodified or alerts you that something changed. This is the behavior VaultGuard has always described — v3.4.1 makes sure it actually happens on every scheduled run.
Download: [VaultGuardBackup_v3.4.1.exe] SHA-256: EA5049464BDAF6C01E83512BE4102005763D9E7A3BC7D89E0DB61CFAB488C942
VaultGuard Backup v3.4.0 (June 10, 2026)
New
Multi-day backup scheduling — run backups on multiple days per week, not just one
Backup Process Selection — choose Full Process, Backup + Integrity, or Backup Only when running manually
Daily backup age check — automatic email alert if backups haven't run within the configured threshold
Recovery from passphrase lockout — locked-out users can initiate the Forgot Passphrase flow directly from the lockout dialog
Per-version integrity tracking — each backup version on disk now gets its own integrity code, not just a single rollup
Live progress during integrity checks and verification — see current read speed (in MB/s) and estimated time remaining while the check is running, even mid-file on multi-hour runs
Improved
Integrity check reads files in larger chunks (16 MB) for much better speed on fast drives — USB 3.0 SSDs and NVMe enclosures see the biggest gains
Integrity check progress is now weighted by file size, so a 400 GB backup file contributes proportionally to the percent complete instead of counting the same as a small metadata file
Customer-facing terminology — "Hash" has been replaced with "Integrity Check" everywhere it's visible to users
Task collision handling — if a scheduled Cloud Copy, Integrity Check, or Backup Verification can't run because another VaultGuard task is in progress, it now retries automatically for up to 3 hours
Logs view now auto-refreshes every 15 minutes and scrolls to the latest entries
Schedule tab loads faster — task status is cached rather than queried on every refresh
Schedule tab task list reordered to match actual operation order: Backup → Integrity Check → Copy → Verification → Age Check → Config Integrity
Backup Integrity History shows live folder size when a stored size is unavailable
Installation Complete dialog now lists all installed scheduled tasks including the new Age Check
Verification is now required and defaults sensibly to the day before your earliest backup day
App icon and all dialog windows now display the ISK logo for consistent branding
Pop-up notifications now appear centered on the VaultGuard window and stay on top — no more popups hiding behind other open applications
"Run Integrity Check Now" locks out the other operation buttons while the check is in progress, preventing accidental conflicts
App window opens wider by default to accommodate the new live progress displays — interior panels widened to match
Verification result text uses clearer labels ("Versions Checked" / "Result") instead of the previous "Integrity Code" labels that were misleading
"User initiated" log entries are now only written after the user actually confirms in a dialog — clicks that get cancelled no longer fill up the audit log
Force-closing the app during a long operation now cleanly stops all background work — no leftover VaultGuard processes hanging around in Task Manager
Fixed
Total Size in the Backup Integrity panel now displays the correct value instead of 0 GB
Integrity Code is now properly computed and displayed for all backup versions
Manifest data is preserved correctly when reading and writing across different formats
Backup chain no longer falsely reports "Integrity Hash Failed" when the check actually succeeded
Mode-aware completion messages — "Cloud Copy: SKIPPED" no longer shows in Backup + Integrity mode
Auto-eject setting now correctly honors the configured value in all paths
License re-validation retries up to 3 times after activation to handle transient relay issues
Passphrase error label no longer overlaps with the "Forgot passphrase?" link
Removed redundant "Scheduled Integrity Check" section from the Integrity tab (info shown in Schedule tab)
Scheduled tasks now fire on the correct day when the configured offset pushes them past midnight — for example, a backup at Wednesday 11 PM with a 3-hour integrity check delay now correctly runs the integrity check on Thursday at 2 AM, not Wednesday at 2 AM
Cloud Copy now always runs AFTER Integrity Check, never before — this protects against pushing a corrupted backup to cloud storage before verification catches the corruption
Scheduled backup no longer crashes during retention cleanup when the "versions to keep" setting is missing from configuration
Integrity records file now saves in a clean format regardless of how many backup versions are tracked
Verification history is now consistently recorded for each individual backup version, not just the most recent
Backup checks no longer fail when the integrity records file is incomplete or contains older-format entries
Security
Passphrases are now hashed with PBKDF2-SHA256 (100,000 iterations + per-install random salt) instead of plain SHA256
Recovery codes are generated with a cryptographically secure random number generator
Recovery is now rate-limited to 3 attempts per hour
A recovery session ends after 3 incorrect code entries and sends a security alert email
Passphrase lockout state persists across app restarts — closing and reopening the app no longer bypasses the 15-minute lockout
Security alerts (lockout, ransomware detected, integrity failure, config tampering, drive health warnings, threats detected) now always send email regardless of the alerts toggle, so you can't miss them
Email alerts now require a valid license key tied to a registered machine — prevents abuse if the relay credentials are ever extracted from the app
Email delivery is rate-limited to 50 messages per hour per license, preventing spam if a license key is ever compromised
Download: [VaultGuardBackup_v3.4.exe] SHA-256: 2794D590D361751AA16275AEEECBBE6596D95C8A014A69DF02462214A1593AB9
v3.3.0 — May 17, 2026
New
Interactive backup browser to navigate any backup version like a file explorer
Search across an entire backup by filename
Restore individual files or whole folders with a single click
Per-backup integrity verification that independently checks each version for tampering, corruption, or ransomware damage
Trust system that tracks every backup's verification history and provenance
Browse a backup the moment the first volume is ready (verification continues in the background)
First-launch detection of existing Windows Server Backup data with a guided walkthrough
Color-coded scheduled task status indicators on the dashboard
Improved
Restore speed: integrity checks now target only the data you're actually restoring instead of the entire backup
Reworked verification scheduling to eliminate timing conflicts with backup tasks
License validation now provides detailed messages when DNS filters, firewalls, or antivirus software interfere
Cleaner, more readable logs that focus on meaningful activity instead of routine noise
Every dialog and prompt now matches the application's dark theme
All dates displayed in standard 12-hour format throughout the app
Refined messaging during long-running operations
Fixed
Failed scheduled tasks now surface clearly on the dashboard instead of failing silently
Download: [VaultGuardBackup_v3.3.exe] SHA-256: C02FACD671322BF6FAD7EFD6B376179A9F1D1BEA80002980C85C0017D886D6FE
v3.2.0 — April 29, 2026
The first publicly available release of VaultGuard Backup. This release brings together months of development with a focus on commercial readiness, hardened licensing, and a smoother first-run experience.
New
Getting Started tab — a five-step setup checklist that opens automatically the first time VaultGuard launches, walking new users through configuration, scheduling, cloud setup, and email alerts.
Detect My Backup Drive — automatically identifies a connected external drive suitable as a backup target, eliminating manual drive-letter configuration.
Find Cloud Backup Folder — detects the local sync folder for any installed cloud storage provider.
Check Cloud Storage — verifies that the configured cloud sync folder is being mirrored by an active cloud sync app, regardless of which provider you use.
Two-factor authentication (TOTP) — optional 2FA support for administrative actions, with QR code provisioning for any standards-compliant authenticator app. As with the optional administrator passphrase, 2FA is available for users who want or need it for compliance, but isn't required to use VaultGuard.
Backup drive disconnected warning — VaultGuard now alerts at startup if the configured backup drive isn't connected, so you don't discover the problem at backup time.
Logs tab summary bar — at-a-glance display of the timestamps for the last successful backup, the last cloud copy, and the last integrity check.
Wake-To-Run — scheduled tasks can now wake the computer from sleep to run a backup, eliminating missed runs on machines that sleep overnight.
Improved
Cloud-provider neutrality throughout — every reference to specific cloud services has been removed from the application UI. VaultGuard now works equally well with any cloud storage provider, with no preference or branding for any specific service.
Schedule tab clarity — recommended and important scheduling labels now display full-width with high-contrast color coding.
License type detection — the application now correctly identifies license tier from the license name on activation, replacing earlier logic that occasionally misreported the type.
Integrity check timing — backup integrity verification now runs exactly 24 hours after each backup completes, ensuring verification work happens at a predictable off-hours time.
License re-validation interval — adjusted to ten minutes (previously evaluated at one minute, which generated unnecessary network traffic).
Log clarity — license type resolution now logs once at startup rather than repeatedly throughout the day, reducing log noise.
Email configuration UX — alert email setup has been consolidated under the Getting Started tab so new users encounter it in the right order.
Fixed
Resolved an issue where the manual "Run Backup Now" button could return wbadmin exit code 255 when invoked through certain Task Scheduler configurations. Manual runs now invoke wbadmin directly.
Corrected an interpolation issue in TOTP URI generation that affected compatibility with some authenticator apps.
Removed a duplicate "license resolved to..." log entry that appeared on every license check.
Security (customer-facing)
Embedded credentials removed. Earlier releases included an embedded Keygen API token and embedded Gmail SMTP credentials inside the compiled binary. As of v3.2.0, license validation and email alerts are routed through a dedicated relay server that holds those credentials separately, with the binary itself authenticated via a per-application key. This significantly reduces the impact of any future binary extraction.
TLS 1.2 enforced for all license validation requests.
Build & distribution
Code-signing with an SSL.com OV certificate
ConfuserEx hardening applied (anti-debug, anti-dump, anti-ildasm, constants encryption, control-flow obfuscation, identifier rename, reference proxy)
Compiled with PS2EXE (-requireAdmin -noConsole -x64); final binary size approximately 380 KB
Download: [VaultGuardBackup_v3.2.0.exe] SHA-256: 2FE0C40362BE08BFC2B00FA8588100CB7FF84D8FE501FF9A5AFF334F06ED725F
v3.1 — late April 2026
The first release with subscription licensing. v3.1 introduced the commercial infrastructure that turned VaultGuard from an internal-use tool into a product that could be sold to customers outside my services practice.
New
Hardware-bound licensing — every license key is now bound to a hardware fingerprint derived from the host machine (motherboard, CPU, and disk identifiers combined and hashed). This is what prevents casual license-sharing.
License activation screen — first-run experience for entering a license key or starting a trial.
Offline grace period — the application continues to operate for up to 7 days if the license validation server cannot be reached due to network issues, then requires successful re-validation.
License expiry cleanup — when a subscription ends, VaultGuard cleanly disables itself rather than failing in unpredictable ways.
Email alert configuration — full configuration UI for SMTP-based alerts on backup events.
Two-factor authentication groundwork — TOTP infrastructure laid in (full UX delivered in v3.2.0).
Session timeout — administrative sessions automatically time out after 10 minutes of inactivity.
Known issues at end of v3.1 (resolved in v3.2.0)
License type was occasionally misreported as the default tier instead of the actual subscription tier.
Keygen API credentials and Gmail SMTP password were embedded in the compiled binary.
Download: Not publicly available — older versions were not retained.
v3.0 — early April 2026
The architectural baseline for the 3.x family. v3.0 was the version that informally rolled out to my Information Security Kentucky services clients before any public availability. It established the core engine — wbadmin-based system imaging, cloud copy, manifest verification, and the multi-tab WinForms interface — that every subsequent release has built on.
New
Core wbadmin Windows system image backup
Cloud copy via robocopy to a sync folder of the customer's choice
Task Scheduler integration for unattended weekly backups
BitLocker monitoring and pre-backup Defender scanning
SHA-256 manifest verification with pre-restore integrity checks
Restore tab including ransomware-extension scanning of backup contents
Optional admin passphrase for users who choose to gate configuration changes behind one
Email alerts via SMTP
Multi-tab WinForms interface — Configure, Schedule, Logs, Restore, About
Download: Not publicly available — older versions were not retained.
Earlier releases (v2.x and older)
VaultGuard's earliest versions were used internally with my services clients before public release as a subscription product.
Staying Informed About New Releases
This page is the authoritative source for VaultGuard release information. For new feature releases, check this page or the [Information Security Kentucky homepage] for announcements.
A more granular notification system — letting you opt in or out of specific release categories — isn't available yet. As VaultGuard's customer base grows, this is one of the first things on the list to build.
Verifying Release Authenticity
Every release listed above is digitally signed by Information Security Kentucky LLC and published with a SHA-256 hash. To verify a download:
Open PowerShell as administrator.
Navigate to the file: cd $env:USERPROFILE\Downloads
Run: Get-FileHash .\VaultGuardBackup_vX.X.X.exe -Algorithm SHA256
Compare the output to the SHA-256 hash listed for that version above.
If the hashes don't match, do not run the file. Email customer service.
If you're reading these notes because something broke after an update, email customer service immediately. Regression bugs in a backup product are unacceptable to me, and I treat them as priority issues. The fastest path to a fix is letting me know.