14. A computer-implemented method, comprising: recording a first occurrence of a first predefined action on a first operating system object open on a computing device; recording a first occurrence of a second predefined action on a second operating system object open on the computing device at the same time as the first operating system object; correlating the first and second predefined actions as occurring at the same time; storing a correlated state comprising the correlated actions relating to the first and second operating system objects; and maintaining a database for storing correlated states.
14. A computer-implemented method, comprising: recording a first occurrence of a first predefined action on a first operating system object open on a computing device; recording a first occurrence of a second predefined action on a second operating system object open on the computing device at the same time as the first operating system object; correlating the first and second predefined actions as occurring at the same time; storing a correlated state comprising the correlated actions relating to the first and second operating system objects; and maintaining a database for storing correlated states. 15. The method of claim 14 , further comprising monitoring actions on the computing device comprising identifying a second occurrence of the first predefined action on the first operating system object; and retrieving the stored correlated state from the database; and instantiating the second operating system object in response to identifying the second occurrence of the first predefined action.