Questions the work can answer
What does it depend on?
DLLs, COM components, drivers, databases, files, registry state, network services, devices and licensing mechanisms.
What behavior must survive?
Inputs, outputs, transformations, validation rules, failure handling and state transitions required for support or replacement.
Where is the data?
Known and proprietary file structures, database access, encoding, configuration and information that can be recovered independently.
Evidence-led workflow
- Define the operational question and legal/ownership authority for the system.
- Preserve binaries, installers, data, configuration and a known working environment.
- Inventory static dependencies, imports, strings, resources and file formats.
- Observe behavior with controlled inputs while tracing files, registry, processes, modules and communication.
- Form hypotheses and test them against multiple cases.
- Produce usable outputs: dependency map, behavior specification, data extractor, protocol model or replacement boundary.
Choosing the depth of analysis
| Need | Usually sufficient |
|---|---|
| Move a working application to new hardware | Dependency and behavior inventory, deployment reconstruction |
| Recover business data | File/database identification plus application-level semantic analysis |
| Replace one integration | Boundary tracing, traffic capture and protocol/file specification |
| Recreate the application | Characterization of critical workflows, edge cases and data rules |
| Diagnose one crash | Focused runtime tracing; full decompilation is rarely the first step |
Inputs and adjacent disciplines
Useful inputs include the exact business objective, executable and installer versions, representative data, access to a working system, known workflows and any failure logs. The broader software reverse-engineering hub explains methods and decision boundaries. Serial devices belong in the communication workflow; unknown data stores may start with database identification. For applications with missing source, see the no-source-code decision framework.