0

This is Windows 7 x64 sp1 on a NTFS file system.

All hardlinks within C:\Windows\System32 folder disappear, and the Windows can't boot, because even the osloader, C:\Windows\System32\boot\Winload.exe also disappeared.

Nevertheless, the original files are still located in the corresponding C:\Windows\winsxs folders. After booting into the Recovery Environment, and copied one Winload.exe (x64) from other folder, Windows gave an error pointing out that "ntoskrnl.exe is corrupted or missing...its file digital signature cannot be verified"

In trying to boot in Safe Mode, the message above was shown after a screen prompting "Loaded \Windows\system32\config\system"

Because at this early booting stage, smss.exe was still not loaded, so there is not any dumping and logs.

Based on my study, ntoskrnl.exe depends on the following files: C:\windows\system32\PSHED.DLL C:\Windows\System32\hal.dll C:\Windows\System32\kdcom.dll C:\Windows\System32\clfs.sys C:\Windows\System32\ci.dll

All those files above are copied from their corresponding folders and verified their md5 with a well-operating Windows 7 x64 SP1. But the booting error is still the same: "ntoskrnl.exe is corrupted or missing..."

Background: 1. Before the reboot, there was an windows update going on. Then something unknown happen, almost all processes were broken to run, including the windows task manager, taskmgr.exe.

  1. After mount the hard disk to other computer, it seems that all hardlinks within C:\Windows\System32 folder were gone.

  2. I tried several data recovery software, but they are not be able to find those disappeared NTFS hard links.

So the question is:
Where are information about those hard links stored? And how to recover them? Are they depend on some windows service or stored in the registry?

EDIT:

Failed in executing "sfc /scannow /offbootdir=c:\ /offwindir=c:\windows" on WinRE (Windows Recovery Environment) with a message:
"Windows Resource Protection could not perform the requested operation."

And there is no backup point made for this system.

  • The information was deleted. You will need a windows recovery disk to solve this problem, do you have one? – Ramhound Aug 19 '14 at 21:46
  • This is how you rebuild the master file table cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair – Ramhound Aug 19 '14 at 21:49
  • @Ramhound The original system was Win 7 installed three years ago, and it was updated to Win 7 Sp1 one year ago. – Rex Aug 19 '14 at 22:31
  • Alright; what's does that have to do with a recovery disk? You need to try to repair the MFT before you do anything else – Ramhound Aug 19 '14 at 23:03

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.