NTFS capture (IN PROGRESS)