Secure ownership and continuity first
- Locate contracts, source repositories, backups, developer machines and shared folders.
- Transfer organization-controlled accounts, domains, certificates, signing keys, cloud services and package feeds through authorized processes.
- Preserve the currently deployed binaries, installer, configuration and database before attempting a new build.
- Identify scheduled jobs, service accounts, external APIs, email relays, devices and manual operator steps.
- Freeze nonessential changes until there is a rollback and recovery path.
Determine the actual recovery state
| State | Next objective |
|---|---|
| Complete source and reproducible build | Document release/deployment, establish version control and reduce key-person dependencies |
| Source exists but build fails | Recover toolchain, dependencies, secrets and generated artifacts using the deployed version as reference |
| Partial or uncertain source | Compare binaries and behavior; identify missing modules and decide whether to reconstruct boundaries |
| No source located | Preserve operation and follow the no-source-code framework |
Reconstruct knowledge from evidence
Interview users about exceptions and failure handling, not just the normal screen sequence. Trace where data enters and leaves. Map deployment from a clean machine. Record which reports, exports and device interactions are operationally binding. Verify repository history against deployed executables rather than assuming the newest folder produced production.
When to maintain, transition or replace
Maintain the existing application when a build can be restored and the system still serves its purpose. Transition incrementally when the core remains valuable but one dependency or workflow creates disproportionate risk. Replace when required behavior is understood, ownership is clear and the old system cannot meet operational or security needs at acceptable risk.
Technology-specific recovery may lead to VB6 support or Delphi support. Undocumented executables and dependencies belong in reverse-engineering discovery; business data should be assessed through the legacy database workflow.
Information to assemble
- Production version and last successful deployment date
- Every candidate source repository and backup
- Build/developer machine images
- Administrator and service-account ownership
- Critical workflows, deadlines and downtime limits