Abstract: The disclosed computer-implemented method for generating memory images of computing devices may include (1) monitoring a computing device to detect changes made to data stored within the computing device, (2) maintaining a log that describes the data changes made by recording, in response to detecting a change made to a portion of data, both a state of the portion of data after the data change occurred and a time at which the data change occurred, (3) detecting an event that triggers generation of an image of the computing device that represents a state of the computing device at a particular point in time, and (4) in response to detecting the event, generating the image of the computing device by incorporating at least a portion of the log of data changes into the image of the computing device. Various other methods, systems, and computer-readable media are also disclosed.