Reverse Architecture: How to Rebuild What No One Documented
When a company has no documentation of its infrastructure, reverse architecture makes it possible to rebuild the complete technical map before any migration or critical change.
"We don't have any documentation."
It is a phrase we hear surprisingly often when we arrive at a new company. Sometimes it comes with an embarrassed apology. Other times, with a resigned shrug. It always comes with a real problem: no one knows exactly what is in the infrastructure, how it is connected, or why it is configured that way.
Reverse architecture is the discipline of rebuilding that knowledge from scratch — not from documents, but from the infrastructure itself.
Why don't companies have documentation?
Before talking about solutions, it is worth understanding why this problem is so common.
Technical documentation has a natural enemy: time. An infrastructure that was documented three years ago no longer reflects today's reality. Servers get added, configurations change, emergency projects leave traces that no one records. Documentation ages faster than it gets updated.
On top of that, documenting does not produce immediate, visible value. An engineer who spends two days documenting the network has nothing tangible to show at the end — unlike one who closed ten support tickets. In most organizations, documentation always gives way to day-to-day emergencies.
The result is predictable: after five or ten years, the infrastructure is a living organism that only two or three people partially understand, and that no one understands completely.
When reverse architecture is critical
There are moments when the lack of documentation goes from being an inconvenience to being a real risk:
- Before a migration to Azure or M365: You cannot migrate what you do not know. A migration without a complete inventory guarantees unpleasant surprises.
- When the "expert" leaves: When the person who knew the infrastructure leaves the company, the knowledge leaves with them.
- During a security incident: Responding to an attack without knowing which systems exist and how they are connected is like fighting a fire with your eyes closed.
- For regulatory compliance: Many certifications (ISO 27001, SOC 2) require up-to-date infrastructure documentation.
- Before hiring a new IT provider: A provider that inherits an undocumented infrastructure takes months to become productive.
The reverse architecture methodology
The reverse architecture process has four phases that are carried out iteratively, not sequentially.
Phase 1: Network discovery
The starting point is always the network. Before we understand what the systems do, we need to know which systems exist.
Active scanning tools:
- Nmap: The industry standard for host and port discovery. A
nmap -sn 192.168.0.0/16scan reveals every active device on the network in minutes. - Advanced IP Scanner: Friendlier for Windows environments; it shows the hostname, MAC address, and device manufacturer.
- Angry IP Scanner: Fast and lightweight, ideal for a first inventory.
The output of this phase is a list of all active IPs with their hostname, operating system (when detectable), and open ports.
Passive discovery tools:
For environments where active scanning could trigger alerts or disruptions, passive network traffic analysis with tools such as Wireshark or ntopng reveals communication patterns without generating additional traffic.
Phase 2: Systems inventory
With the list of hosts in hand, the next step is to understand what each one is.
For Windows environments with Active Directory:
Active Directory is a gold mine of information. The following PowerShell commands reveal the complete inventory in minutes:
# All computers in the domain
Get-ADComputer -Filter * -Properties * | Select Name, OperatingSystem, LastLogonDate
# All servers
Get-ADComputer -Filter {OperatingSystem -like "*Server*"} -Properties OperatingSystem
# All users and their groups
Get-ADUser -Filter * -Properties MemberOf | Select Name, MemberOf
Microsoft Assessment and Planning (MAP) Toolkit:
This free Microsoft tool is especially valuable for preparing migrations. It automatically generates a detailed inventory of hardware, software, server roles, and licensing status — without installing agents on the servers.
Azure Migrate:
For environments that will eventually move to Azure, Azure Migrate can automatically discover and assess on-premises servers, producing an inventory with CPU, memory, and storage utilization metrics over 30 days.
Phase 3: Dependency mapping
The inventory tells you what exists. Dependency mapping tells you how it is connected — and this is the most complex and most valuable part.
Network traffic analysis:
Tools such as NetFlow, sFlow, or firewall log analysis reveal which systems communicate with each other, how often, and on which ports. A 30-day traffic map is enough to identify the critical dependencies.
Application log analysis:
Logs from IIS, SQL Server, Exchange, and other applications reveal which systems query them and how often. A server that receives queries from 15 different systems is clearly critical, even if no one ever documented it as such.
Structured technical interviews:
Technology does not reveal everything. Interviews with system administrators, developers, and business users uncover tacit knowledge: "that server doesn't show up anywhere, but if we turn it off, billing goes down," "someone created that scheduled task five years ago and no one knows what it does, but no one touches it either."
Phase 4: Documentation and validation
With discovery complete, the last step is to turn the data into useful documentation and validate it with the technical teams.
Architecture diagrams:
We use draw.io or Visio to create diagrams at three levels:
- Logical network diagram: Network segments, VLANs, firewalls, DMZ.
- Server diagram: All servers with their roles, operating systems, and relationships.
- Application diagram: Business applications with their infrastructure dependencies and integrations with one another.
Structured inventory:
An Excel workbook or a database listing each server, its role, its operating system, its installed applications, its dependencies, and its business criticality.
Basic runbooks:
For the most critical systems, we document the basic operating procedures: how to restart the service if it fails, what to check if there is a problem, and whom to escalate to.
A real case: 47 servers, zero documentation
In a recent project for a financial services company in Central America, we walked into an environment with 47 physical and virtual servers and no documentation of any kind. The previous IT administrator had left the company six months earlier.
The reverse architecture process took three weeks:
- Week 1: Network discovery and initial inventory with the MAP Toolkit and Nmap. Result: 47 servers identified, 12 of which no one on the current team knew the purpose of.
- Week 2: Dependency analysis using firewall logs and interviews with business users. Result: a complete map of integrations, including three "ghost" servers that turned out to be critical for payroll processes.
- Week 3: Documentation, validation with the technical team, and classification by criticality.
The final deliverable was a complete architecture diagram, an inventory of 47 servers with documented roles and dependencies, and a criticality classification that made it possible to prioritize the migration to Azure.
The subsequent migration went significantly more smoothly than any migration we have done without this prior process.
Recommended tools by category
| Category | Tool | Cost | Best for |
|---|---|---|---|
| Network discovery | Nmap | Free | Initial inventory |
| Windows inventory | MAP Toolkit | Free | Migration preparation |
| Azure assessment | Azure Migrate | Free | Migrations to Azure |
| Traffic analysis | Wireshark | Free | Network dependencies |
| Diagrams | draw.io | Free | Visual documentation |
| Continuous monitoring | Azure Monitor | Included in Azure | Post-migration |
Documentation as a strategic asset
Reverse architecture is not just a technical exercise — it is the recovery of a strategic asset that the organization gradually lost.
A well-documented infrastructure reduces incident resolution time, makes it easier to onboard new team members, enables informed investment decisions, and is a prerequisite for any successful technology transformation.
At Barona Enterprise, reverse architecture is the first step of every migration or modernization project. Not because it is mandatory, but because we have learned — sometimes the hard way — that trying to transform something you do not fully understand is a bet that rarely pays off.
