All of the NTFS hard links damaged, where are those 0kb hardlinks stored and how to recover them?

0

This is Windows 7 x64 sp1 on a NTFS file system.

All hardlinks within C:\Windows\System32 folder disappear, and the Windows can't boot, because even the osloader, C:\Windows\System32\boot\Winload.exe also disappeared.

Nevertheless, the original files are still located in the corresponding C:\Windows\winsxs folders. After booting into the Recovery Environment, and copied one Winload.exe (x64) from other folder, Windows gave an error pointing out that "ntoskrnl.exe is corrupted or missing...its file digital signature cannot be verified"

In trying to boot in Safe Mode, the message above was shown after a screen prompting "Loaded \Windows\system32\config\system"

Because at this early booting stage, smss.exe was still not loaded, so there is not any dumping and logs.

Based on my study, ntoskrnl.exe depends on the following files: C:\windows\system32\PSHED.DLL C:\Windows\System32\hal.dll C:\Windows\System32\kdcom.dll C:\Windows\System32\clfs.sys C:\Windows\System32\ci.dll

All those files above are copied from their corresponding folders and verified their md5 with a well-operating Windows 7 x64 SP1. But the booting error is still the same: "ntoskrnl.exe is corrupted or missing..."

Background: 1. Before the reboot, there was an windows update going on. Then something unknown happen, almost all processes were broken to run, including the windows task manager, taskmgr.exe.

  1. After mount the hard disk to other computer, it seems that all hardlinks within C:\Windows\System32 folder were gone.

  2. I tried several data recovery software, but they are not be able to find those disappeared NTFS hard links.

So the question is:
Where are information about those hard links stored? And how to recover them? Are they depend on some windows service or stored in the registry?

EDIT:

Failed in executing "sfc /scannow /offbootdir=c:\ /offwindir=c:\windows" on WinRE (Windows Recovery Environment) with a message:
"Windows Resource Protection could not perform the requested operation."

And there is no backup point made for this system.

Rex

Posted 2014-08-19T21:31:05.683

Reputation: 101

The information was deleted. You will need a windows recovery disk to solve this problem, do you have one? – Ramhound – 2014-08-19T21:46:20.510

This is how you rebuild the master file table http://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair

– Ramhound – 2014-08-19T21:49:21.043

@Ramhound The original system was Win 7 installed three years ago, and it was updated to Win 7 Sp1 one year ago. – Rex – 2014-08-19T22:31:16.930

Alright; what's does that have to do with a recovery disk? You need to try to repair the MFT before you do anything else – Ramhound – 2014-08-19T23:03:20.797

No answers