1. A method for emulating a file on a computer system, the method comprising: loading the file into an emulator of the computer system; determining whether an emulation is being performed for the first time or not; when the emulation is performed for the first time, emulating the file using an initial image of the emulator state; during emulation of the file, creating and storing one or more new images of the emulator state upon occurrence of one or more predefined conditions that resulted when running the emulation, and loading a state of virtual file system, a virtual registry, and a tree data structure of virtual objects into the emulator while detecting malicious codes in the computer system; when the emulation is not performed for the first time, identifying one or more new images of the emulator state created during an initial emulation of the file; and loading into the emulator the one or more identified images of the emulator state-to be used for emulating the file.