5. The computer-implemented method of claim 4 , wherein storing the first state of the computing device further comprises storing a correlation between the first event and one or more of the identified operating system objects.
4. The computer-implemented method of claim 1 , wherein storing the first state of the computing device comprises identifying operating system objects that are instantiated at the time of the first event.