Forensic Code Assessment
I examine what makes changes and releases difficult in your established system. You receive documented findings from code, architecture and development workflows, plus a prioritized roadmap ordered by impact, effort and dependencies. This gives you a basis for planning stabilization and modernization.
For CTOs and IT leaders responsible for established software systems.
Fixed price for the agreed scope. Examination time starts once all data and access are available.
14+ years working with established .NET systems.
// Symptoms
These patterns indicate where an examination of your codebase can start.
Manual approvals and regressions delay deployments.
A small change causes failures in other modules.
Only a few people understand the business-critical core.
Coverage rises while failures in operation go undetected.
Refactor or rebuild? The evidence for a decision is missing.
Troubleshooting displaces product work and ties up experienced engineers.
// The cost of unresolved causes
Recurring failures consume development time. The assessment identifies which causes to address first.
More about the cost of unresolved causesBefore the next investment
Which sources of failure and dependencies should your team investigate or address first?
Which findings support targeted changes, and what remains unresolved before a rebuild?
Which technical risks and knowledge gaps do you need to explain to your team and management?
Inside a published project
In an anonymized assessment of AI-assisted software delivery, acceptance criteria were identified as a way to improve quality. Security and dependency signals were translated into validation and update steps.
View the findings and approach in the project exampleLemgo, OWL / remote DACH
// Your expert
I investigate established systems because they need to run reliably in day-to-day operations and support controlled changes. "Understand before judging" means examining code, Git history and technical evidence before I recommend changes. I consider code, development workflows and team knowledge together. I discuss the findings with your team and use them to identify prioritized next steps.
The assessment is a standalone engagement. Your team can use the report to continue independently.
Discuss the examination scope View full profile →// Areas of analysis
Code, history and development workflows in context. Your package determines the depth of examination.
Complexity, coupling and cyclic dependencies.
Frequently changed modules, failure-prone areas and knowledge distribution.
Test quality, coverage and untested failure scenarios.
Builds, deployment processes and rollback capability.
Locking patterns, async/await and potential failure paths in the code.
Dependencies between teams and modules, and knowledge concentrated in individuals.
// Optional starting point
If you want an initial view of your release risks, you can use the free Release Risk-Check. The check is optional and is not required for an inquiry.
About 10 minutes · Anonymous use available · No code access
// Deliverables
Findings, priorities and next steps for management and engineering.
Fictional sample data for illustration. The scope and detail of your report depend on the agreed package.
The main risks and options on two pages. Your management can use this to agree on budgets and the order of next steps.
Fictional sample
Findings linked to code, with the limits of the examination stated. Your engineering team can check the evidence and work on the affected areas.
Fictional sample
Actions ordered by impact, effort and dependencies. Management and engineering can use this to plan implementation.
Fictional sample
// Process
Standard: 5 working days. Full Forensic: 10 working days. From complete provision of the agreed data and access.
Agree on questions, system boundaries and access.
Review code, Git history and pipelines.
Examine hotspots, coupling and failure paths.
Document causes and prioritize actions.
Discuss findings with management and engineering.
// Project examples
Selected development and stabilization projects. This experience informs my examination of your codebase.
Research, enterprise, analytics
Enterprise app, project example
Analytics platform, project example
Published anonymously
// The difference
The Forensic Code Assessment provides evidence for deciding which changes to make next.
// Pricing & packages
Choose based on your question, system setup and required examination depth. Company size alone does not determine the package. We agree on scope and schedule before starting.
Focused diagnosis
€5,000 fixed price, net plus VAT
Codebase: up to 3 repositories (up to 500,000 LOC)
10–15-page decision memo, two-page summary and prioritized roadmap.
A combined 60-minute briefing for management and engineering.
In-depth examination
€9,000 fixed price, net plus VAT
Codebase: up to 8 repositories / unlimited LOC
30+ page dossier, executive summary and prioritized roadmap.
90-minute management briefing, 120-minute engineering review and 45-minute follow-up after 30 days.
The timeline starts once all data and access are available. Runtime profiling and the separate AI Forensic Assessment are not included in either package.
Repository and LOC figures describe the codebase that can be included. We agree on questions, technologies and examination depth before starting. The assessment does not include an exhaustive review of every line of code.
On small screens, scroll the table horizontally.
| Audit dimension / criterion | Standard | Full Forensic |
|---|---|---|
| Repository & code scopeCodebase and services examined | up to 3 repositories (up to 500,000 LOC) | up to 8 repositories / unlimited LOC |
| Forensic audit layersArchitecture, churn, concurrency, tests, organization | Layers L1 to L3 (static analysis, churn, baseline) | Extended audit layers excluding runtime/dump analysis |
| Git history & bus factor analysisIdentify risks from dependence on individuals | Module level | Module & subsystem level including Conway audit |
| Concurrency & thread safety checkDeadlocks, race conditions, async/await pitfalls | Pattern analysis through sampling | In-depth audit of synchronous & asynchronous locks |
| Runtime profiling & memory leak detectionHeap dumps, GC spikes, unmanaged resource tracking | Not included | Planned extension, not included |
| Mutation testing (test quality audit)Automated injection of artificial faults to assess test quality | Coverage statistics & sanity check | Mutation analysis of core domains |
| Documentation formatWritten findings for management & development | 10–15-page decision memo | 30+ page dossier including ROI prioritization |
| Live closing presentationInteractive explanation & Q&A | 1 × 60-minute combined briefing | 2 sessions (90-minute management briefing + 120-minute developer deep dive) |
| Follow-up after 30 daysReview of initial implementation measures | Available as an optional booking | Included (45-minute follow-up) |
Assessment inquiry
Describe your system and your question. We agree the scope, package and start date together.
FAQ
I examine established, business-critical software systems in the Forensic Code Assessment. We first establish whether your questions, technologies and available evidence fit the engagement. My technical experience includes C#, .NET and distributed architectures in particular.
Read-only access to the agreed repositories, technical documentation and build information. Access to production systems or customer data is not needed.
Standard: 5 working days. Full Forensic: 10 working days. The period starts once all agreed data and access are fully available.
We agree on the kick-off and review beforehand. Standard includes a combined 60-minute briefing. Full Forensic includes 90 minutes for management, 120 minutes for engineering and a 45-minute follow-up after 30 days.
Before starting, we agree on repositories, data sources and questions. A bilateral NDA template is available in advance on request.
No. The Forensic Code Assessment is a standalone engagement. Implementation is not included. You can continue with your own team or a partner.