All of the NTFS hard links disappear, where are those 0KB hardlinks stored on disk and how to recover them?

Question

This is Windows 7 x64 sp1 on a NTFS file system.

All hardlinks within C:\Windows\System32 folder disappear, and the Windows can't boot, because even the osloader, C:\Windows\System32\boot\Winload.exe also disappeared. Nevertheless, the original files are still located in the corresponding C:\Windows\winsxs folders. After booting into the Recovery Environment, and copied one Winload.exe (x64) from other folder, Windows gave an error pointing out that "ntoskrnl.exe is corrupted or missing...its file digital signature cannot be verified"

In trying to boot in Safe Mode, the message above was shown after a screen prompting "Loaded \Windows\system32\config\system"

Because at this early booting stage, smss.exe was still not loaded, so there is not any dumping and logs.

Based on my study, ntoskrnl.exe depends on the following files:  
C:\\windows\\system32\\PSHED.DLL  
C:\\Windows\\System32\\hal.dll  
C:\\Windows\\System32\\kdcom.dll  
C:\\Windows\\System32\\clfs.sys  
C:\\Windows\\System32\\ci.dll  

All those files above are copied from their corresponding folders and verified their md5 with a well-operating Windows 7 x64 SP1. But the booting error is still the same: "ntoskrnl.exe is corrupted or missing..."

**Background:**

1. Before the reboot, there was an windows update going on. Then something unknown happen, almost all processes were broken to run, including the windows task manager, taskmgr.exe.

2. After mount the hard disk to other computer, it seems that all hardlinks within C:\Windows\System32 folder were gone.

3. I tried several data recovery software, but they are not be able to find those disappeared NTFS hard links.

So the question is:
Where are information about those hard links stored? And how to recover them? Are they depend on some windows service or stored in the registry?

EDIT:

Failed in executing "sfc /scannow /offbootdir=c:\ /offwindir=c:\windows" on WinRE (Windows Recovery Environment) with a message:
"Windows Resource Protection could not perform the requested operation."

And there is no backup point made for this system.

Answer 1

It would be vastly faster and easier to just reimage/restore from backups. Rule of thumb for the desktop techs who work under me is that if you can't fix the problem in an hour, it's time to re-image the box.

In your case, it sounds like the system rebooted or crashed in the middle of a Windows update, while it was updating a bunch of system files, so who knows what files and links are missing in addition to %Windows%\System32\Ntoskrnl.exe. The obvious quicky fix is to copy ntoskrnl.exe to %Windows%\System32\, but it sounds like there's a lot more wrong, so it could take a long time just to get the thing to boot, nevermind getting it to work properly again after booting.

If you don't have a good imaging program or backups, you can always try reinstalling Windows over itself to replace the missing/corrupt files and hardlinks. (And then you'll want to go through all the Windows updates again to get everything up to the proper version, or you can run into some really strange behavior.)

Where are information about those hard links stored? And how to recover them? Are they depend on some windows service or stored in the registry?

To answer this specific question, they're file system objects. Like files, they exist on the filesystem, in a directory, and do not depend on any services or get stored in the registry (although, as with most things Windows, you can edit the registry to create hardlinks on boot/login/other event triggers). If they're not there, then they're just gone. Hardlinks can be deleted just like files can, and as you've already tried recovery software without success, it seems you know the answer to your other question. You can't recover them, at least not in this case - you need to reimage/reinstall/restore from backups.

Answer 2

"ntoskrnl.exe is corrupted or missing...its file digital signature cannot be verified"

You might need to check the catalog files in c:\Windows\System32\catroot\ . Also, the manifest files (*.man) in WinSxS subforlders might be corrupted.

You can try using the SFC utility sfc /SCANNOW /OFFBOOTDIR=d:\ /OFFWINDIR=d:\Windows or sfc /SCANFILE=d:\Windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\Windows to repair the installation.