Recovery of state, configuration, and content for virtualized instances

A non-transitory computer-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for enabling storage and analysis of data associated with virtual computing instances, the operations comprising:

• identifying a virtual computing instance;
• archiving, in at least one data storage system, delta data for the virtual computing instance, the delta data representing a plurality of differences between a first state of the virtual computing instance and a second state of the virtual computing instance, wherein the plurality of differences are based on a plurality of operations performed on the virtual computing instance;
• reinstantiating the virtual computing instance based on the archived delta data;
• simulating, based on the reinstantiated virtual computing instance, one or more previous states of the virtual computing instance;
• and
• performing a forensics operation on the reinstantiated virtual computing instance.