- root->d_inode->i_creation_time = le64_to_cpu(ni->creation_time);
- root->d_inode->i_last_write_time = le64_to_cpu(ni->last_data_change_time);
- root->d_inode->i_last_access_time = le64_to_cpu(ni->last_access_time);
- root->d_inode->i_attributes = le32_to_cpu(attributes);
- root->d_inode->i_ino = ni->mft_no;
- root->d_inode->i_resolved = 1;
-
- if (attributes & FILE_ATTR_REPARSE_POINT) {
- /* Junction point, symbolic link, or other reparse point */
- ret = capture_ntfs_streams(root, ni, path, path_len,
- lookup_table, ntfs_vol_p,
- AT_REPARSE_POINT);
- } else if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
-
- /* Normal directory */
+ inode->i_creation_time = le64_to_cpu(ni->creation_time);
+ inode->i_last_write_time = le64_to_cpu(ni->last_data_change_time);
+ inode->i_last_access_time = le64_to_cpu(ni->last_access_time);
+ inode->i_attributes = le32_to_cpu(attributes);
+ inode->i_resolved = 1;
+
+ if (attributes & FILE_ATTR_REPARSE_POINT)
+ stream_type = AT_REPARSE_POINT;
+ else
+ stream_type = AT_DATA;
+
+ /* Capture the file's streams; more specifically, this is supposed to:
+ *
+ * - Regular files: capture unnamed data stream and any named data
+ * streams
+ * - Directories: capture any named data streams
+ * - Reparse points: capture reparse data only
+ */
+ ret = capture_ntfs_streams(inode, ni, path, path_len,
+ params->lookup_table, vol, stream_type);
+ if (ret)
+ goto out;
+
+ if (ni->mrec->flags & MFT_RECORD_IS_DIRECTORY) {
+
+ /* Recurse to directory children */