Consumer electronics PCB reverse engineering takes a finished product board — a soundbar amp, a robot vacuum main board, a TV power supply, a Bluetooth earbud charging case — and turns it back into editable engineering data: schematic, netlist, BOM, and Gerber/drill files you can send to a fab. You mail us the board (or two, if you have a spare), we image and trace it, and you get files plus a written note on anything we couldn’t fully resolve.
This page is written for the person who already has the board in hand and needs the data. If you’re deciding whether the whole approach makes sense, the background on what PCB reverse engineering actually involves covers that first.
Why consumer boards are their own category of problem
Industrial boards are usually generous. Two or four layers, 0603 passives, silkscreen reference designators on every part, through-hole connectors, a socketed MCU in a DIP or wide QFP. Consumer boards are the opposite, because the product was designed to hit a price and a thickness target.
What that means in practice:
- Everything is 0402 or 0201. Some phone-adjacent and wearable boards go to 0201 across the entire passive count. Under a microscope these are readable, but you cannot read a value off the part — most are unmarked, so capacitors and resistors have to be measured in circuit or desoldered and measured.
- House-marked and sanded ICs are common. A four-character in-house code on a SOT-23-6 tells you nothing. Identification then comes from behavior: pinout, what’s on each pin, what the surrounding network looks like, and what parts fit that footprint and that function.
- Silkscreen is minimal or absent. Cost-optimized panels often drop reference designators entirely, or print them only on one side.
- Layer count is high relative to board size. A 40 × 60 mm main board with a Wi-Fi SoC and an eMMC can easily be six or eight layers with blind and buried vias, which changes how the board has to be taken apart.
- RF sections exist. Antenna feed, matching network, shield can footprints. Copper geometry there is functional, not cosmetic, and it has to be reproduced dimensionally rather than “close enough.”
Flex and rigid-flex show up constantly too — display tails, hinge cables, touch panel FPCs. Those need different handling than a rigid FR-4 board, and the bend regions matter.
What actually happens to your board, in order
1. Documentation before anything destructive
The board gets photographed at high resolution, both sides, with a flatbed or camera rig and consistent lighting. Then it’s scanned or measured for outline, mounting holes, connector positions, and board thickness. If there’s a shield can, we record its footprint before removing it. Everything reversible happens before anything irreversible.
On dense multilayer boards, X-ray comes next. It shows via structures, whether vias are through, blind, or buried, and what’s underneath the BGA that you’ll never see optically.
2. Component identification and BOM build
Parts are catalogued position by position. Marked parts get looked up. Unmarked passives get measured — capacitance, resistance, and for inductors, inductance and DCR. Semiconductors get identified from package, pin function, and circuit role. Where a house-marked IC can’t be pinned to a specific part number, we say so explicitly and describe the function and pinout instead of guessing at a part number that might send you to the wrong device.
3. Component removal and layer imaging
Components come off under hot air or with an IR preheater, tracked back to their positions. Then each copper layer is imaged. On a two-layer board that’s a scan of top and bottom after solder mask removal. On a six-layer board, the stackup is separated layer by layer, imaged one at a time, and each image is registered against the drill pattern so the layers line up correctly.
Registration is the step that quietly decides whether the result is any good. If layer 3 is off by 50 µm relative to layer 1, every buried via connection is suspect.
4. Netlist, then schematic
Copper images become a net-by-net connectivity map. That netlist is then checked electrically against the physical board with a meter — continuity probes on the nets that matter, especially power, ground, and anything crossing between layers through a buried via. Only after the netlist survives that check does it get drawn as a readable schematic with functional blocks separated out: power input and regulation, MCU or SoC core, RF, audio, motor drive, user interface.
A schematic that’s electrically right but drawn as one giant sheet of spaghetti isn’t useful to you. Block organization is part of the deliverable.
5. Gerber and fabrication data
Copper layers, solder mask, silkscreen, paste, drill file, and stackup with dielectric thicknesses. For boards with controlled-impedance requirements — USB differential pairs, MIPI display lanes, an RF feed line — the stackup and trace geometry get reported together, because a fab that builds your layers to a different thickness will change the impedance even with identical copper.
What we need from you, and what you get back
To quote, send this. It takes five minutes and it’s the difference between a real number and a vague range.
- Clear photos of both sides of the board, whole board in frame, on a dark non-reflective background, in focus, no flash glare. Add close-ups of any dense areas.
- Board dimensions — length, width, and thickness if you can measure it.
- The main chip markings, typed out or in a legible close-up. MCU, SoC, power management IC.
- What you want, in one line: schematic only, schematic plus BOM, full Gerber set for fabrication, or all of it.
- Whether firmware is involved. Say yes or no. It changes the scope completely.
What comes back from us: a feasibility assessment (including anything on the board we flag as difficult), a lead time, a price, and a deliverable list. If we think part of the board can’t be resolved cleanly, you hear it before you pay, not after.
| Deliverable | What it’s for | What drives the effort |
|---|---|---|
| Netlist only | Verifying connectivity, debugging, repair | Layer count, via structure |
| Schematic + BOM | Redesign, part substitution, obsolescence work | Unmarked part count, house-marked ICs |
| Gerber + drill + stackup | Refabricating the bare board | Layer count, blind/buried vias, impedance control |
| Full package + assembled samples | Restarting production of a discontinued product | All of the above plus sourcing and BGA rework |
Honest limits: where this gets hard or stops working
Six things make a consumer board harder, and two can make part of it infeasible.
Harder, but doable: HDI with stacked microvias; BGA and QFN packages with no visible pads; unmarked passives in the hundreds; potted or conformally coated assemblies; flex and rigid-flex sections; and any RF block where trace geometry has to be reproduced to spec rather than approximated.
Sometimes not feasible as requested: a board where a package-on-package stack or an embedded component sits between layers, and a board so mechanically damaged — burned through, delaminated, chunks missing — that the copper in the damaged region simply isn’t there to read. A second sample solves the damage case almost every time. It’s the single most useful thing you can send.
Firmware is a separate question from copper. If the product’s behavior lives inside a read-protected MCU, refabricating the PCB gives you a bare board that boots nothing. Firmware extraction depends on the specific part and how it was locked — an AVR or 8051 with lock bits set, an STM32 at RDP Level 1 versus Level 2, an MSP430 with the JTAG fuse blown, and a modern SoC with secure boot are four very different situations with very different odds. Nobody honest guarantees any of them in advance.
You need to hold the rights to the design you’re sending, or authorization from whoever does. Every project runs under NDA, files go back to you and nowhere else, and we don’t take work aimed at knocking off somebody else’s active product.
Legitimate reasons consumer product owners come to us
The pattern is boringly consistent. A product sold well for four years, the original layout engineer left, the CAD files were on a laptop that died, and now a critical part went end-of-life and the board needs a respin. Or the contract manufacturer that owned the files stopped answering email. Or a field failure needs root-cause analysis and there’s no schematic to trace against.
Obsolescence is the biggest one. A discontinued power management IC or a Wi-Fi module that went end-of-life forces a redesign, and you can’t redesign a board you have no data for. Recovering the schematic first, then re-laying-out around the replacement part, is faster and lower-risk than designing from scratch. The same logic applies in industrial control board recovery, where the service life is longer but the problem is identical.
What drives the price and the schedule
There’s no flat rate, and anyone quoting one before seeing photos is guessing. The variables:
- Layer count. Every added layer is another separation, imaging, and registration cycle.
- Board area and component count. 600 parts on a 50 mm board is a different job than 80 parts on a 150 mm board.
- Via structure. Blind and buried vias mean the connectivity map has to be built per layer pair.
- Unmarked and house-marked parts. Each one is a measurement or an identification exercise.
- BGA presence. Ball-out mapping requires X-ray and careful cross-referencing.
- Deliverable set. A netlist is much less work than a full fabrication package with impedance-controlled stackup.
- Whether firmware
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quoteRelated reading