17. The method of claim 14 , further comprising: receiving a subsequent request to instantiate the first operating system object when the first operating system object is closed; and comparing the request to instantiate the first operating system object with correlated states in the database.
14. A computer-implemented method, comprising: recording a first occurrence of a first predefined action on a first operating system object open on a computing device; recording a first occurrence of a second predefined action on a second operating system object open on the computing device at the same time as the first operating system object; correlating the first and second predefined actions as occurring at the same time; storing a correlated state comprising the correlated actions relating to the first and second operating system objects; and maintaining a database for storing correlated states.