- if (attributes & FILE_ATTR_REPARSE_POINT) {
- /* Junction point, symbolic link, or other reparse point */
- ret = capture_ntfs_streams(inode, ni, path,
- path_len, lookup_table,
- vol, AT_REPARSE_POINT);
- } else if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
+ if (attributes & FILE_ATTR_REPARSE_POINT)
+ stream_type = AT_REPARSE_POINT;
+ else
+ stream_type = AT_DATA;
+
+ /* Capture the file's streams; more specifically, this is supposed to:
+ *
+ * - Regular files: capture unnamed data stream and any named data
+ * streams
+ * - Directories: capture any named data streams
+ * - Reparse points: capture reparse data only
+ */
+ ret = capture_ntfs_streams(inode, ni, path, path_len,
+ params->lookup_table, vol, stream_type);
+ if (ret)
+ goto out;
+
+ if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {