Follow this narrated 8-minute demonstration in Osmon. Learn how to position eight probes, check top and side views, adjust scan range, recover weak signals and resolve Guristas Vigil and Guristas Lookout.
These are combat sites; this lesson demonstrates scanning rather than relic/data hacking.
Begin in high security space with a cheap Magnate or Heron. Learn the interface before taking valuable cargo into dangerous space.
Fit a Core Probe Launcher I, carry at least 8 Core Scanner Probes I plus spares, and fit Relic Analyzer I and Data Analyzer I. Add propulsion and scanning rigs. Train the required scanning, Archaeology and Hacking skills. Alpha pilots should use T1 exploration frigates; do not plan around cloaking.
Open the Probe Scanner and solar-system map. Anomalies can be available without probes; cosmic signatures need scanning.
Launch 8 probes and choose a pinpoint formation. Begin with a broad range, such as 8 AU, over the signature region.
Analyze. Move the entire formation to the result, checking both the top and side views so the probes surround it in three dimensions.
Reduce range progressively: 4 AU, 2 AU, 1 AU, then smaller as required. Recenter after each result. If strength drops, widen one step and adjust.
At 100% the signature becomes warpable. Read the site type, bookmark it and assess the risk before warping. Recall your probes when finished.
Approach a container, target it and activate the matching analyzer within its listed range: Relic Analyzer for relic containers; Data Analyzer for data containers.
Click connected nodes to explore the grid and locate the system core. Your virus has coherence (health) and strength (damage). Defensive nodes fight back; attack only when needed. Collect utilities and use them deliberately. A Restoration Node or Virus Suppressor can make the remaining hack harder, so deal with its effect promptly. Destroy the core to unlock the container, then open it and take the loot.
Failed attempts can destroy containers depending on the site. Treat each attempt as limited. Watch the overview and directional scanner during the minigame; close it and leave when danger appears.
Relic/data labels do not guarantee safety. Sleeper sites, ghost sites and other special variants can contain NPCs, explosions or timers. Beginners should identify ordinary pirate relic/data sites and skip unfamiliar variants until they understand them.
In wormholes, bookmark the entrance immediately and keep a route out. Local does not provide a reliable list of everyone present. Directional scan helps but cannot reveal every threat. A quiet system is not proof of safety.
Resolve one signature to 100%, identify the site, complete one suitable hack and dock the loot. Success is returning safely, not filling every cargo slot.
Official reference: CCP scanning guide
The three illustrated reference panels show the core, defensive systems and utilities you can meet during a hack. Coherence is health; Strength is damage per attack. Your virus must survive long enough to disable the System Core. You do not need to clear every defensive system.
Explore open routes and collect useful tools instead of attacking every Firewall.
Deal with Restoration Nodes and Suppressors when you can do so efficiently.
Use Self Repair early; save shields and targeted damage tools for fights that matter.
Once the core is reachable, compare its Coherence with your Strength and remaining Coherence. Use utilities before committing if needed.
Disable the core to finish, then loot the unlocked container. Keep watching your surroundings.
Example: with 30 virus Strength, a 70-Coherence target needs three normal hits. Kernel Rot reduces it to 35 Coherence, so two normal hits finish it, assuming no healing or other effects. The killing hit normally prevents that target’s retaliation; fewer hits can preserve your virus.
Data Caches: may reveal a useful tool or another defensive subsystem. Explore accessible adjacent nodes first and open caches when you need the potential reward; an unlucky defensive reveal can block your path.
Image reference and further reading: EVE University — Hacking. The illustrations are supplied reference images; use live in-game tooltips for the hack in front of you.
Firewall: a large health pool with relatively low damage. It can take several attacks to remove. Go around it if another route is open; consider Kernel Rot when you must break through.
Anti-Virus: less health but higher damage. It can quickly drain your virus during an exchange. Use a shield or another utility when the fight is unavoidable.
Restoration Node: adds 20 Coherence to a random defensive subsystem at the end of a turn; it does not heal the core. Remove it promptly when practical so it cannot make other fights longer.
Virus Suppressor: reduces your virus Strength by 15, with a minimum Strength of 10. It is a high-priority target because leaving it active makes subsequent attacks weaker. A Secondary Vector is especially useful here.
Defensive nodes block exploration into adjacent unrevealed nodes while active. They do not all have to be destroyed: spend Coherence only when it opens a useful route, removes a harmful effect or reaches the core.
Click a revealed utility to collect it into an available utility-belt slot. Clicking its icon in the belt activates it; targeted tools then need a target. Collecting a utility is different from using it.
Self Repair: restores 5–10 virus Coherence per turn over three turns. Use it early so its ticks have time to work. Your virus has no normal maximum Coherence cap, so there is no benefit in waiting merely to avoid “overhealing”.
Kernel Rot: cuts the target’s current Coherence in half. Apply it before normal attacks against a high-health target, such as a tough Firewall or core.
Polymorphic Shield: blocks the next two enemy attacks against your virus. Activate it before an unavoidable fight with a high-Strength enemy. It blocks attacks, not two arbitrary exploration clicks.
Secondary Vector: deals 20 Coherence damage per turn for three turns. Apply it to a difficult target, then take other useful actions while it works. It helps clear a Suppressor without relying on your suppressed attack Strength; avoid wasting its damage by immediately over-attacking the same target.
The core is your winning target. Its icon is generally green for easier hacks, yellow for medium and red for hard hacks. The chart above compares enemy Coherence and Strength: the upper number is Coherence and the lower number is Strength. Red crosses mean that subsystem is absent from the listed standard difficulty, not that you should click there.
The chart’s “Hardest” row applies to particular special content, not every ordinary relic/data site. Event and special-site rules can differ. In very easy/easy hacks, an Anti-Virus can appear from a Data Cache. The missing footnotes in the cropped chart matter: read the live node’s statistics rather than assuming every hack follows one fixed table.