+base name of \fISOURCE\fR. If \fIDESCRIPTION\fR is not given, no description is
+given to the new image.
+
+.SH NORMAL MODE
+
+The normal image capture mode is entered when \fISOURCE\fR specifies a
+directory. The WIM image will be captured from the directory tree rooted at
+this directory. The directory may be on any type of filesystem.
+
+In this normal image capture mode, we capture the following information from the
+directory tree:
+
+.IP \[bu] 4
+The "normal" name and contents of each file and directory
+.IP \[bu]
+File and directory creation, access, and modification timestamps to the nearest
+100 nanoseconds, if supported by the underlying filesystem
+.IP \[bu]
+Hard links and symbolic links
+
+.PP
+
+However, in the normal image capture mode, we do \fInot\fR capture the following
+information from the directory tree:
+
+.IP \[bu] 4
+File permissions. The resulting WIM image will not contain any security
+descriptors because the format of the security descriptors is Windows-specific,
+and they cannot contain UNIX file modes.
+.IP \[bu]
+No alternate data streams will be captured, since these do not exist on
+POSIX-compliant filesystems. The resulting WIM image will not contain any
+alternate data streams.
+
+.SH NTFS MODE
+
+A special image capture mode is entered when \fISOURCE\fR is a regular file or
+block device. \fISOURCE\fR is interpreted as an NTFS volume and opened using
+libntfs-3g. If successful, a WIM image is captured containing the contents of
+the NTFS volume, including NTFS-specific data.
+
+Please note that the NTFS image capture mode is \fInot\fR entered if
+\fISOURCE\fR is a directory, even if a NTFS filesystem is mounted on
+\fISOURCE\fR. You must specify the NTFS volume itself (and it must be
+unmounted, and you must have permission to read from it).
+
+More specifically, in this mode, we capture the following types of information
+from the NTFS volume:
+
+.IP \[bu] 4
+All data streams of all files, including the un-named data stream as well as all
+named data streams.
+.IP \[bu]
+Reparse points, including symbolic links, junction points, and other reparse
+points.
+.IP \[bu]
+File and directory creation, access, and modification timestamps from NTFS
+inodes (these have a resolution of 100 nanoseconds).
+.IP \[bu]
+The security descriptor for each NTFS inode.
+.IP \[bu]
+File attribute flags.
+.IP \[bu]
+All names of all files, including names in the Win32 namespace, DOS namespace,
+Win32+DOS namespace, and POSIX namespace. This includes hard links.