For anything complex, you'll probably need a combination of both approaches (or some method of examining the existing codebase), and then go down another layer of whys. Why is the code written the way it is in the context of the business goals? Why is there this undocumented behavior? Why does the business requirement say x while the code does y?