1. A non-transitory computer-readable medium embodying a program executable in a computing device, the program comprising: code that, in response to a first customer request received via a web services application programming interface operated by a service provider, stores an execution state of an original virtual machine instance, the execution state corresponding to a specific point in time; code that stores a series of timestamped events received by the original virtual machine instance after the specific point in time; code that receives a second customer request via the web services application programming interface, the second customer request indicating a time period and a request to run a clone virtual machine instance of the original virtual machine instance for the time period; code that determines that the time period indicated in the second customer request includes a portion of the stored series of timestamped events of the original virtual machine instance stored after storing the state at the specific point in time; code that instantiates, in response to the second customer request, the clone virtual machine instance using a machine image from which the original virtual machine instance was instantiated, wherein instantiating the clone virtual machine instance includes applying the stored execution state of the original virtual machine instance at the specific point in time to the clone virtual machine instance initiated from the image of the original virtual machine image and applying timestamped events from the stored series of timestamped events prior to the beginning of the requested time period to move the state of the clone virtual machine instance forward in time to the beginning of the requested time period.