A method of determining at least a portion of a state of one or more programs at a plurality of points in time, the method comprising: obtaining (412, 506, 734) as a baseline image a baseline state of the one or more programs, and applying (412, 506, 734) to the baseline image one or more pre-images successively from most recently to least recently logged, thereby reconstructing the state of a memory of one or more programs at a time earlier than the baseline image; obtaining (412, 506, 734) one or more register state snapshots (X306, X307, X308) comprising a state of one or more registers; and retrieving and interpreting (412, 506, 734) the one or more pre-images from newest to oldest and maintaining a representation of the state of the memory of the one or more programs at a given time, and using the one or more register state snapshots (X306, X307, X308) to reconstruct the state of the one or more registers at the given time, wherein: at least one change that occurred in the state of the one or more programs has been recorded as logged changes by logging at least part of the state that changed, said part of the state that changed has been logged by logging as a pre-image at least a representation of said part from a time prior to the occurrence of each of the logged changes, and at least some of the one or more register state snapshots (X306, X307, X308) are not logged at a time of occurrence of a change to a value stored in the one or more registers, and wherein the method enables analysis of most recent execution history of the one or more programs without waiting for earlier parts of logged data representing execution history to be retrieved, downloaded, or decoded and bounds the amount of logged data that must be traversed to reconstruct the state of the one or more registers. obtaining (412, 506, 734) as a baseline image a baseline state of the one or more programs, and applying (412, 506, 734) to the baseline image one or more pre-images successively from most recently to least recently logged, thereby reconstructing the state of a memory of one or more programs at a time earlier than the baseline image; obtaining (412, 506, 734) one or more register state snapshots (X306, X307, X308) comprising a state of one or more registers; and retrieving and interpreting (412, 506, 734) the one or more pre-images from newest to oldest and maintaining a representation of the state of the memory of the one or more programs at a given time, and using the one or more register state snapshots (X306, X307, X308) to reconstruct the state of the one or more registers at the given time, wherein: at least one change that occurred in the state of the one or more programs has been recorded as logged changes by logging at least part of the state that changed, said part of the state that changed has been logged by logging as a pre-image at least a representation of said part from a time prior to the occurrence of each of the logged changes, and at least some of the one or more register state snapshots (X306, X307, X308) are not logged at a time of occurrence of a change to a value stored in the one or more registers, and at least one change that occurred in the state of the one or more programs has been recorded as logged changes by logging at least part of the state that changed, said part of the state that changed has been logged by logging as a pre-image at least a representation of said part from a time prior to the occurrence of each of the logged changes, and at least some of the one or more register state snapshots (X306, X307, X308) are not logged at a time of occurrence of a change to a value stored in the one or more registers, and wherein the method enables analysis of most recent execution history of the one or more programs without waiting for earlier parts of logged data representing execution history to be retrieved, downloaded, or decoded and bounds the amount of logged data that must be traversed to reconstruct the state of the one or more registers.