SharePoint Content Types have a family history embedded in their ID, not unlike regular surnames. If "Johnson" means "son of John", then "Johnsonson" could mean "son of son of John", right? A custom Content Type based on an existing Content Type should have an ID created with this formula: parent Content Type ID + "00" + GUID-with-all-punctuation-removed. (That's two hexadecimal zeros in the middle.) If a Site Content Type with this kind of ID is added to a List, the process gets repeated; that is, another "00"+ GUID-with-all-punctuation-removed is appended to the end.
Example:
The built-in Task Content Type's ID is 0x0108.
A custom Site Content Type derived from the Task Content Type would have an ID like
0x010800EBA40770DD49424B926071790A814012
A List Content Type derived from the custom Site Content Type above would have an ID like
0x010800EBA40770DD49424B926071790A81401200370F78BCFAEA4507A78FA725393A8055
You'll be glad to know that Content Type IDs have a maximum length of 512 bytes! (Of course, that's 1024 hexadecimal characters.)
Finding all the child Content Types is easy – use the static method SPContentTypeUsage.GetUsages(SPContentType), which returns a collection of each use of a Content Type (parent and children) anywhere in the Site Collection.
SPSite site = SPContext.Current.Site;
SPWeb web = site.RootWeb;
SPContentType parentContentType = web.ContentTypes["Task"];
if (null != parentContentType)
{
IList<SPContentTypeUsage> usages = SPContentTypeUsage.GetUsages(parentContentType);
foreach (SPContentTypeUsage usage in usages)
{
// There are three interesting properties of SPContentTypeUsage:
// Url, Id, and IsUrlToList
// Url is a server-relative URL to either a List or a Site
// Boolean "IsUrlToList" TRUE indicates a server relative Url for the root folder
// of the List
// Boolean "IsUrlToList" FALSE indicates a server-relative Url for the Site
// Id is the actual Content Type ID that was found
if (usage.IsUrlToList)
{
// Do List Content Type stuff
}
else
{
// Do Site Content Type stuff
}
}
}
Just for fun, let's see an example of that in PowerShell:
$w = Get-SPWeb http://intranet/operations
$TaskCT = $w.AvailableContentTypes["Task"]
$uses = [Microsoft.SharePoint.SPContentTypeUsage]::GetUsages($TaskCT)
$uses | Format-Table

Enjoy!