Software Archeology

Software Archaeology

The Measurement Layer That Protects Your Rebuild Budget from a Bad Estimate


Legacy rebuild quotes usually price the system someone can see. Its real size and real risk rarely match the documentation, and the gap runs in both directions at once, inflating scope and hiding risk.

We measure your system in file-level evidence before anyone prices a rebuild, so your budget and board narrative rest on facts. On one system, a documented 4,000,000 lines measured 409,833 in true scope.

Arrange a Measurement Review //

Why Legacy Rebuild Estimates Go Wrong, and What Software Archaeology Fixes

icon

Your rebuild quote prices dead, generated, and vendored code you never needed to rebuild

icon

Undocumented plug-ins and unopened native components hide risk that no line count shows

icon

Your documented system size can be off by a factor of three to ten, in either direction

icon

Critical business logic lives only in code nobody has read in years, with no spec behind it

icon

Your team can’t tell which legacy components can be ported and which need a full rebuild

Software Archaeology Case Studies

Software archaeology has measured legacy systems in regulated, safety-critical domains, from industrial control to healthcare and GIS. The first case shows 3.6M lines removed from rebuild scope.

Browse Our Portfolio //
corsactech case studies

4,000,000 Lines on Paper, 409,833 in Scope: How Software Archaeology Produced a Defensible Modernization Budget

Documented vs. measured size

4,000,000 → 409,833 lines

Taken off the documented figure

3.6M lines
Read more //
corsactech case studies

Delivery Process Transformation for GIS Platform: From Ad-Hoc Support to Resilient Delivery Flow

Reduced hotfix release time by

70%

Achieved backlog visibility of

100%
Read more //
corsactech case studies

From 3 Days to 3 Hours: AI-Empowered Antibiotic Susceptibility Testing Modernization

Antibiotic Susceptibility Test Time

72h → 3h

AI Bacterial Classification Accuracy

95%
Read more //

What You Get from Software Archaeology

Two things come out of this: what your system actually is, and what fixing it will cost, backed by evidence.

Request a quote //

    From the archaeology:

  • List icon

    A measured, auditable size — per module, classified per file

  • List icon

    An exhaustive, technology-neutral specification of a system that had none

  • List icon

    A numbered, complexity-rated requirement index that every estimated hour traces to

  • List icon

    Keep-versus-rebuild decisions with their long-term cost named

  • List icon

    Every delivery option judged against the same requirements

  • List icon

    An executable baseline of legacy behavior, captured before the rebuild begins

  • List icon

    A numbered register of what’s still unknown, each rated by impact

    From the estimate that follows:

  • List icon

    Effort in hour ranges with one planning figure, showing both likely cost and risk

  • List icon

    Every delivery option costed in full against its own requirements

  • List icon

    A roadmap that starts with discovery before any construction begins

  • List icon

    A stable team, with the capacity math behind the timeline shown openly

  • List icon

    Both a plan that fits your deadline and the plan we would recommend

  • List icon

    Gates with pass criteria fixed in advance, so acceptance is never a debate

No Two Engagements Are Alike, So Each Assessment Is Sized to Your System

1

System size

Classified on seven dimensions beyond line count; when they conflict, we take the larger reading

2

Data complexity

Scored separately, and overrides system size for anything touching the database

3

Assessment depth

From a half-day fast-track to a full, formal architecture review

4

Engagement shape

Validate a plan you already have, or build the roadmap from zero

5

Codebase shape

Multi-repository systems add a service map and real coordination multipliers

Software archaeology on two components that looked like full rebuilds

A legacy quote often prices a component by its label: a project called “UI” goes in as a UI rewrite, and code tied to the operating system is written off as platform-locked.

In two of our assessments, our analysts opened the code before accepting either label, and both verdicts changed.

result

“UI project” where 65% of the code could be ported or decoupled

Almost two thirds of the module’s code was portable or cheaply decoupled despite its UI label.

  • Assumed: The module carried a UI label, so a project-level quote would have priced all 47,491 hand-written lines as interface rewrite work.
  • What we did: Our analysts classified every file and counted interface touch points in the ambiguous ones to separate real UI work from logic that only imports a UI namespace.
  • What we found: 35% of the module needed a true rewrite. Across the full engagement, the same rule showed 63% of the runtime as portable or cheaply decoupled.
  • Verdict: Port or decouple most of the module and budget a rewrite only for the 35% that needs it.

A “platform-locked” C/C++ component that turned out 83% portable

Only about 1,640 of the component’s 9,892 lines were tied to the operating system.

  • Assumed: The component looked bound to the operating system, so the default call was to rebuild it from scratch without reading the code.
  • What we did: Our team decomposed it layer by layer and separated the OS-bound shell from the code beneath it.
  • What we found: The shell held the component object surface, windowing framework, and legacy drawing calls. The other 8,252 lines, a portable graphics layer and a platform-independent core, could be ported with the rest of the system.
  • Verdict: Port the component. Rebuilding it in full would have cost roughly 5x more.

Evidence You Can Audit

Every number in our proposal walks back to a file and a line of source, so your technical team or a due diligence reviewer can check any figure. Findings are graded by how we know them: measured, statically derived, or client-stated.

The Unknowns Are a Deliverable Too

An assessment that hides what it couldn’t determine is worse than useless, because the gap resurfaces in month three, when it’s expensive. On one recent engagement, we handed over 42 open verification items, 14 scope alerts, 12 documented contradictions, and 16 client-owned dependencies, each numbered and impact-rated, before pricing.

What This Catches in Practice

On one engagement, this found a library referenced by twenty projects whose source was in none of the supplied archives — before it became a delivery surprise. On another, an early finding of heavy coupling was disproved under review, and the recommendation changed accordingly.

How Much of Your Legacy System Is Worth Keeping?

On one system, 63% proved portable or cheap to decouple. Let’s measure yours.

See What You Can Keep //

What Our Software Archaeology Assessment Covers

Six phases, each answering a question that changes the price — architect-reviewed at every boundary, so no phase moves forward on an unverified number.

modernization-solution

Scope

We verify exactly what you’re asking us to price and against which constraints, before any number gets attached. Every delivery option that could apply is logged with its evidence, because an option missed here never gets costed, so nothing moves forward until the inventory is confirmed against source code.

Architecture

We check whether your documentation and your code actually agree — building as-is and to-be maps and an interface table, then cataloguing every contradiction between documents, interviews, and source. Where they diverge, the code wins, and the gap becomes a tracked finding in the estimate.

Measurement

We measure how much of your system genuinely has to be rebuilt — module by module, file by file, with generated, vendored, duplicated, and out-of-scope volume identified and excluded by name. Inflated line counts get corrected in both directions: dead code stops being priced as work, and hidden risk stops being invisible to the count.

Requirements

We reverse-engineer the specification your system was never given — every process, state machine, permission, and screen, indexed as numbered, complexity-banded requirements that hours can attach to. Effort is estimated against what the system actually does, since line counts mislead in either direction.

Freezability

For every subsystem, we decide what can be kept and what must be rebuilt, and name the ongoing compatibility cost of each freeze decision. Some legacy components are a portable core in a platform-specific shell, and porting them costs far less than a rebuild.

Stack

We judge every target technology against the same requirements — suitable, awkward, or fails, no favorites — and hand over a distilled manifest your estimate is built from. The decision is documented against evidence, independent of the stack our team prefers to build in.

Deep Research at Machine Scale. Judgment by Our Architects.

We use AI agents for what they’re genuinely good at: exhaustive, uniform research across an entire codebase, at a speed no manual review reaches. What they produce is evidence but never a decision. That distinction is what keeps the method safe.

result

What the Agents Do

They classify every file by the same rule, recover every enumeration value by value, and cross-reference a meeting transcript against a diagram against a line of source — exhaustive, tireless work humans do badly by hour six.

What the Architects Do

Every finding goes to a solution architect, who brings the thing no tool has: domain experience. They decide what a contradiction means, which reading of an ambiguous scope is real, what’s safe to assume, and what has to be escalated to you — and they own the number that results.

We Estimate the AI Benefit Honestly

We band the AI leverage by work type — high for repetitive, machine-checkable transformation, near zero for coordination and customer-owned dependencies — then subtract the verification burden it creates. The realistic net effect is around 20%, not 50%. Anyone claiming AI halves the cost of modernizing a safety-relevant system is selling something.

Our Software Archaeology Techniques

Square icon

Modernization is our core specialization

We aren’t a full-stack agency. We modernize legacy systems ourselves, so the specification we recover becomes the artifact the delivery team plans and builds from.

Square icon

Integration vs. Disruption

We work inside your Git, CI/CD, and tools, and analysis of your source runs locally, so your code stays where it belongs and your developers keep shipping.

Square icon

We classify code file by file, never project by project

A UI project is routinely majority non-interface code. We classify every file and count touch points in ambiguous ones, turning a 100%-rewrite assumption into 63% portable or cheaply decoupled work.

Square icon

We open native and legacy components layer by layer

A platform-locked component is often a portable core in a platform-specific shell. On one 9,892-line component, only ~1,640 lines were OS-tied — porting avoided ~33,700 lines of unneeded work.

Square icon

We reverse-engineer the specification the system never had

Effort should come from what a system does, not lines of code that mislead both ways. On one system, this recovered 438 numbered requirements and flagged 88 as safety-relevant.

Square icon

Respect for Existing Architecture and Leadership

Measurement often shows that much of a system can be kept or ported. We evolve the functioning parts and rebuild only what the evidence says must change.

Our Software Archaeology Approach

Structured Framework

Every engagement runs on the same documented, eleven-stage lifecycle — presale triage, five assessment stages, five execution stages — versioned and improved after every project. Results are repeatable across the team, not dependent on which architect is free.

Deep Archaeology

When a wrong number would be commercially expensive, assessment deepens into a dedicated six-phase pipeline: scope, architecture, measurement, requirements, freezability, stack. Each phase produces evidence the next one builds on, not an assumption it inherits.

Architect Review at Every Phase

Square

A senior architect reviews and signs off at every phase boundary — no phase proceeds on the previous phase’s unreviewed output. At each checkpoint, the architect:

Square

Validates every measurement against its cited evidence

Square

Decides what a contradiction between docs, interviews, and code actually means

Square

Judges which reading of an ambiguous scope is the real one

Square

Flags what’s safe to assume and what has to be escalated to you

Full Traceability

The chain runs evidence → requirement → complexity band → hours → proposal figure, walkable both ways. When a line item is challenged, we answer with the file and the line it came from.

Arrange a call now

Book an expert consultation to uncover gaps in your system. Let us modernize your business to its maximum potential.

Connect with Experts //

Proving the New System Behaves Like the Old One

Building the replacement isn’t the hard part. Proving it does the same thing is. Documented requirements describe intent; legacy code describes fact — and after years of drift, the two quietly diverge. The code is the source of truth for what the system does; the requirements are the source of truth for what was agreed to change.

The Baseline Is Captured Before the Rebuild Begins

We extract business rules from the legacy source, each with a file-and-line reference and a confidence rating, and turn them into a real, committed golden-master test suite. It has to pass green against the legacy system first: a test that can’t pass against the system it was captured from is a bad test, not a finding.

A Deterministic Test Suite Decides Pass or Fail

Specialist agents read code, derive behavior, and explain differences, but none of them decides pass or fail. An AI judgment can reach a different conclusion on a re-run with no code change. The verdict comes from the committed suite running against both systems, so the answer is the same every time it’s asked.

Already Have a Rebuild Quote? Have It Checked Against Your Code First

If you already have a plan or vendor estimate, we validate it against your actual system.

Validate My Estimate //

Industries

Healthcare
AEC and GIS
Sport
Banking & Financing
Charity and Non-profits
Cybersecurity
Speech Recognition

Software features we build and modernize:

  • Telemedicine and Remote Communication
  • Electronic Medical Documentation
  • Physical and Mental Health Monitoring
  • Child Development Tracking
  • Fall Detection and Movement Tracking
  • Hearing Assessment and Audio Testing
  • Relaxation and Emotional Support
  • AI-Powered Infection Diagnostics
Read more //

Software features we build and modernize:

  • Interactive Object Mapping
  • GNSS Equipment Integration
  • Utility and Infrastructure Mapping
  • Geospatial Data Management
  • Metadata and Interment Record Management
  • Advanced Project Management
  • Visual Analysis and Defect Detection
  • Social Monitoring and Service Mapping
  • Web and Mobile Access to Geospatial Data
  • Data Security and Access Control
Read more //

Software features we build and modernize:

  • AI-Based Motion Tracking
  • Ball and Equipment Tracking
  • Multi-Angle Camera Coordination
  • Performance Analytics and Heatmaps
  • Training Insights and Feedback
  • Integration with Wearables and External Devices
Read more //

Software features we build and modernize:

  • API Management & API Gateway
  • Microservices and Digital Transformation
  • Cloud Platform Integration
  • Security and Regulatory Compliance
  • Advanced Banking Domain Services
  • Analytics and Monitoring
  • Open Banking Solutions
  • Omnichannel Support
Read more //

Software features we build and modernize:

  • Project Discovery & Search
  • Donation Management
  • Organization & Project Profiles
  • Transparency, Reporting & Impact Metrics
  • Service Finder
  • Volunteer & Community Engagement
  • Grant & Funding Opportunities (For Non-governmental organisations)
  • Partner & Corporate Programs
  • Mobile Accessibility
  • Data Insights & Policy Recommendations
Read more //

Software features we build and modernize:

  • Security Operations Center (SOC) as a Service
  • Incident Response & Recovery
  • Cybersecurity Audits
  • Compliance & Certification Support
  • Security Trainings
  • Vulnerability Scanning & Penetration Testing
  • Endpoint, Network, and Cloud Security
  • Offensive AI Technology
Read more //

Software features we build and modernize:

  • Real-Time Voice-Tracking Engine
  • Adaptive Script Following
  • Offline Speech Recognition
  • Multilingual Voice Processing
  • Noise-Tolerant Recognition
Read more //

Corsac’s Experts

List icon

Specialists in Measuring Legacy Systems Before They Are Priced

We assess systems that grew for years, often with documentation that no longer matches the code.

List icon

Evolving Existing Architecture and Leadership

We show which parts can be kept or ported, protecting your investment and the CTO’s credibility.

List icon

Evidence for Regulated and Safety-Critical Systems

Safety-relevant requirements are flagged as needing evidence, which supports HIPAA, SOC 2, and GDPR reviews.

List icon

Your Source Code Stays in Your Environment

Analysis runs locally, and every finding traces back to a file and a line of source.

List icon

Getting Rid of “Dark Tech Debt”

We name the hidden costs a line count misses, from unopened components to missing source, before they reach your budget.

List icon

Modernization that Fuels Leadership

You get ranged estimates, every option costed, and gates fixed in advance, ready for your board.

Most Outsourcing Vendors

List icon

Focus on Delivery vs. Your Business Goals

They quote the rebuild you ask for without checking what really needs rebuilding.

List icon

Lack Domain Expertise

Generalist teams miss the safety and compliance details of healthcare, industrial, and GIS systems.

List icon

Apply a Standardized Modernization Approach

One estimating template for every system, whatever its size, data, or codebase shape.

List icon

Disregard Your Existing Opportunities

They price a full rewrite without checking which components could be ported or kept.

List icon

Lack Integration with Your Team

Insufficient collaboration leads to poor handover, with documentation debt and weak enablement.

List icon

Code-First Mindset

Estimates start from line counts and tool output before anyone confirms what the system does.

Tell Us About the System You Need Measured

An engineer reviews every request. We sign an NDA before discussing your code.

    By signing this form you agree to our Privacy Policy

    Steps:

    • 1 We review your request within 1–2 business days.
    • 2 We schedule a call to learn about your system and the decision you need to make.
    • 3 You receive a proposed assessment scope, depth, and estimate.

    Corsac Technologies Corporation

    +1 416 505 4524 Toronto, Canada info@corsactech.com

    Frequently Asked Questions

    It’s the discipline of establishing what a legacy system actually is — its true size, its undocumented behavior, its real requirements — in measured, file-level evidence before a modernization estimate is built. Guesswork gets replaced with a specification.

    A standard audit samples and reports impressions. Software archaeology measures: classifying every file, reverse-engineering a full requirement index, and grading every finding by how it’s known — measured, statically derived, or client-stated. Every number walks back to a file and a line.

    In our experience, client-stated line counts differ from the true in-scope size by a factor of three to ten — usually in both directions at once: dead and vendored code inflates the total while hidden structural risk stays invisible to any count.

    It depends on your system and the decision at stake. Depth ranges from a half-day fast-track to a full architecture review, and work that would typically take one to two weeks is compressed into a fraction of that, with an architect reviewing every phase before it moves forward.

    The reliable approach splits the work in two: AI agents do the exhaustive, uniform research — classifying files, recovering enumerations, cross-referencing sources — at a speed no manual review reaches. Every finding then goes to a human architect, who validates it before it is priced.

    Yes. When you already have a plan, the work narrows to validating it against your actual system, and every part is still checked before anyone commits to it.