Abstract: A method and apparatus for storing and retrieving any prior state of a computer system is provided. Upon installation of the system, a base image corresponding to the initial state of the computer system is established and stored on a storage device. The system monitors changes to the state of the host and subsequently stores at least some of these changes on the storage device. These changes are then mapped by location of the stored changes in an address table to enable subsequent retrieval of any selected changes. When the address table becomes full, at least one differential image of the state of the system is subsequently created by compiling all changes to the base image which occurred between creation of the base image and the selected time. A virtual image may thus be created of data stored on the storage device, as such data existed at a predetermined prior point in time, from which data and files may be retrieved and written to the host disk.