9. A non-transitory computer-readable storage medium having instructions encoded therein that, when executed by at least one processor, cause the at least one processor to perform operations comprising: at a first time, identifying a first event on a computing device; in response to identifying the first event, storing a first state of the computing device including storing a log of the first event and storing an identification relating to one or more operating system objects associated with the first state of the computing device; at a second time after the first time, identifying a second event on the computing device; determining, from the log of the first event, that the second event is similar to the first event; and in response to determining that the second event is similar to the first event, causing the one or more operating system objects associated with the first state of the computing device to be instantiated on the computing device.
11. The non-transitory computer-readable storage medium of claim 9 , wherein the second event comprising instantiating a particular operating system object associated with the first event.