The first hours in an old application are mostly about resisting the urge to change it. Before touching code, I want to know what the system believes its job is and where data enters.
Start with the edges
I trace one request from its entry point through validation, domain rules, persistence, and notification. At each boundary I write down external systems and assumptions, then look for a small seam where a test can observe behavior safely.
Once the edges are visible, the interior becomes less intimidating. You do not need to understand every class before making a useful observation about the system.
A small, accurate map is more valuable than a large, confident guess.