A write filter is used to handle write operations by an operating system of a computing device that has a main storage medium in which the operating system image is stored. The write filter is placed in the operating system to intercept write commands for writing state data into the main storage medium and to write the state data onto a non-volatile auxiliary storage medium to prevent the state data from being lost when the device is shut down. The write filter creates checkpoints (or watermarks) for the state data in the non-volatile memory to protect them from being written over and to allow the system to roll back to a previous state. The write filter also enables the operating system image in a writable main storage medium of the computing device to be replaced with a new operating system image while the operating system is still running through by gradually copying the new image into the main storage while moving the old image into a look-aside buffer in the RAM.