A system can determine to uninstall a patch that is installed on a computer, wherein an image of an operating system of the computer and a package that was used to install the patch are cryptographically signed. The system can further identify a first stored location of the package, and a second stored location of the image of the operating system. The system can further extract a file manifest from the package at the first stored location. The system can further extract versions of files identified on the file manifest from the image of the operating system at the second stored location, resulting in extracted versions of files. The system can further store the extracted versions of files to a temporary storage location. The system can further move the extracted versions of files in the temporary storage location to respective original running locations of the versions of files.