AbstractMaintainers of old code often need to discover where particular program features are implemented. This paper presents a method, called ‘software reconnaissance’ for answering this question through an analysis of the execution of different test cases. The method is quite easy to implement, requiring only a test coverage monitor, some simple tools, and a surprisingly small number of test cases.A statistical case study is presented that shows the kind of results that can be obtained on a typical medium‐sized program. The method seems to be effective in identifying a small number of code components that are unique to a particular program feature, though it may not find all components that make up the feature's delocalized plan. A small protocol case study shows that professional programmers can learn to use the method quickly and can use the information that it produces.Software reconnaissance may be a simple but useful addition to the maintainer's tool kit in that it provides starting points for understanding a large program and a way of recovering some requirements traceability information from old code. For the researcher, it also provides a novel functionality ‘view’ of software that maps features to program components at different levels of