diff --git a/tsk/fs/fs_attrlist.c b/tsk/fs/fs_attrlist.c
index ede0a7c0ac3358147079639c7fec15ebd1233ad1..40a262a3c65e4dfb77e58d48f5e25a33e1a7eaed 100644
--- a/tsk/fs/fs_attrlist.c
+++ b/tsk/fs/fs_attrlist.c
@@ -341,6 +341,13 @@ tsk_fs_attrlist_get_name_type(const TSK_FS_ATTRLIST * a_fs_attrlist,
                     || (fs_attr_ok->id > fs_attr_cur->id))
                     fs_attr_ok = fs_attr_cur;
             }
+
+            else if ((name) && (fs_attr_cur->name) && fs_attr_cur->type == TSK_FS_ATTR_TYPE_NTFS_DATA && !stricmp(fs_attr_cur->name, name)) {
+                // NTFS data streams should do case insensitive compare
+                // make sure we return the lowest if multiple exist
+                if ((fs_attr_ok == NULL) || (fs_attr_ok->id > fs_attr_cur->id))
+                    fs_attr_ok = fs_attr_cur;
+            }
         }
     }