Abstract: Embodiments of the invention provide novel systems, methods and software for replaying one or more events occurring on a monitored computer (or elsewhere). Such solutions can provide the ability for an operator to easily determine the exact user behavior that produced the event and can, in some cases, and provide evidence of what the user did, and the order in which the user performed the various activities. Various embodiments of the invention organize various pieces of information captured from the user's client workstation behavior, reassemble of the pieces into a complete session of the users' activities and/or replay the exact user behavior for the observer, in some cases using a web browser and JavaScript to replay the activities just as they were performed by the original user.