[dpeck]

After a while you just get a feel for it.

One of the best heuristics I had when approaching a system for the first time was to start poking at non-core features that were probably bolted on late. Things like management portals whether web or console, user customization settings, anywhere arbitrary files can be fed into the system. Those areas usually very fruitful and what I learned there helped understand and contextualize later research and discoveries in the core components.