[neomerlin]

Here's a couple question for those of you who don't leave hacking out of your game/behind the scenes...

Matrix runs in 5e are built largely around infiltrating hosts. They are the systems where most of the useful/valuable data is and where interesting things are happening. They're also really hard beat. Sample hosts we see in the books rarely have dice pools less than 12 for anything. But that's fine, because 5e was written with the great idea of encouraging deckers to get in close to the action and exploit direct connections and master/slave connections to bypass a host's security. It works great.

Until you need to steal a file. Assuming you can get past file protection, using Edit File on a file in a host is opposed by the Host, and unlike most cases when you go up against a Host, there's no way to come at a file sideways or exploit a weak link in the security. At least, not as far as I can see in RAW. Considering for the most part the decking rules are written around the idea of finding weaknesses, this seems like a big oversight in a major part of matrix crime.

How do you deal with this? Do the Deckers just have to suck it up and big their digital fists against the wall until they beat it? Maybe throw Edge at it? After all, since Edit File is a Data Processing action, it's one thing that doesn't set off security or build OS. In that case, is it better just to let a decker "take 20" and assume they roll until they get lucky and move on? Or have I missed/have you come up with a way to bypass the Host's security on files?

Tangentially related, I'm curious about how Patrol IC functions in your game. Patrol IC is running at all times in many Hosts and it tries to spot icons doing something illegal with Matrix Perception. Data Trails tells us how often they make a Perception roll against any individual icon in the Host. But what exactly are they looking for and what sets them off? As far as I can tell, running silent isn't illegal, once you're hacked your way into a host you're considered a legitimate user, so just being there isn't going to set it off. If you're not running silent or Patrol has spotted you, is it then always watching and knows when you perform an illegal action? Or does it only catch you if it succeeds on a Perception the same Turn you do something illegal?

[Stainless Steel Devil Rat]

The rules don't address the infinite possibilities, but you can do what real-world hackers do: social engineer the frag out of the system.

Do a dumpster dive to find an organizational chart.  Figure out who's going to have legit access to the part of the host your target file is within.  Access the host from his direct-connection terminal in the office.  or call him up and tell him you're the metroplex password inspector and he needs to confirm with you his password is up to snuff.  Have a pretty runner of your mark's preferred gender ploy the honey pot scheme.  Etc.  Added benefit: these stratagems allow the entire team to contribute rather than having the decker deck up the macguffin from the host while everyone else waits.

[Hobbes]

Edge and high dice pools is the traditional way. 

Matrix Perception on the Marks on the File and then find the Persona that belongs to those Marks is a way to come at them sideways.  Potentially very time consuming though. 

Or deduce logically who would have marks on the target file and track that person down.

Hack that commlink for a Password perhaps, or Control Device and see if you can get the Commlink to do an Edit File action on the target file and send you a copy.  Or Con, Intimidate, Mind Control the actual meat body corresponding with that Persona. 

BTW, hilariously, by strict RAW reading Edit File is always an opposed test even if you are the owner of the file.

"No don't save it to the Host... ah, crap.  Guess we better dig into the black budget and get another Shadowrun team.  What should we have them do this time...?" 

[neomerlin]

Interesting. Sounds like you folk have taken a pretty similar angle to how I resolved it for my game. The most expedient method the decker has utilised for grabbing files is to find a device with full access privileges to the file (usually an administrator's cyberterminal or a worker's commlink) that is slaved to the host and that she thus has a direct connection to and using Control Device to make it copy the file for her. I reasoned this was an obvious solution because, I believe somewhere in data trails, it mentions that files in an archive can be retrieved either with a foundation run or by finding a device that can pull it out of the archive. Can't find that particular quote at the moment, though.

And of course more options present themselves if you can access the meat body of the owner, like y'all say.

Related but perhaps getting a bit tangential from this forum (and more into the rules forum) but I noticed this morning that the core book says about Edit File:

The defender against this test is either the host holding the file or the owner of the file (if it’s not on a host).

Is it explicit somewhere that a decker need marks on the file icon itself or on the host/owner? It could be interpreted that if the owner/host is defending, it and not the file itself, is the target of the Action.

[Hobbes]

Is it explicit somewhere that a decker need marks on the file icon itself or on the host/owner? It could be interpreted that if the owner/host is defending, it and not the file itself, is the target of the Action.

The Edit File action requires one Mark on the file.  If the File is on a Host, the Host defends. 

[neomerlin]

Is it explicit somewhere that a decker need marks on the file icon itself or on the host/owner? It could be interpreted that if the owner/host is defending, it and not the file itself, is the target of the Action.

The Edit File action requires one Mark on the file.  If the File is on a Host, the Host defends.

That is my gut feeling without having yet had the chance to go over the books closely. I was asking in case somebody happened to know off hand if/where that is explicit.