1. A method of checkpointing in a mobile device, comprising: observing mobile device behaviors over a period of time to recognize mobile device behaviors that are inconsistent with normal operation patterns; storing mobile device state information in a memory as a stored checkpoint when it is determined that the mobile device behaviors are consistent with normal operation patterns; and uploading the stored checkpoint to a backup storage system in response to determining that the mobile device behaviors are not consistent with normal operation patterns.