Defense PCB Reverse Engineering: Cost and Lead Time

Cost and lead time for defense PCB reverse engineering are driven by five things: layer count, component density, whether conformal coating or potting has to come off, whether any programmable part needs its firmware recovered, and which deliverables you actually need. A four-layer analog interface card with 120 parts is a short job. A ten-layer digital board under a poured urethane shell with a locked DSP is not. Send photos and a parts count, and you get a feasibility answer and a quoted lead time before anything is invoiced.

This page is written for the person who has a dead line replaceable unit, a supply chain that dried up in 2009, and a program manager asking when the spare will be available.

Why defense boards land on our bench in the first place

Almost every defense reverse engineering request we see traces back to one of four situations, and the situation changes the scope more than the board does.

• Obsolescence. The board is fine, but three parts on it went end-of-life and the OEM has no drop-in. You need the design data so a form-fit-function replacement can be built and qualified.
• Lost data package. The program owns the design, but the CAD files left with a subcontractor that closed, or exist only as a 1990s-era plot on vellum. You need current Gerber, schematic, and BOM in a modern tool.
• Sustainment quantity. Twelve spares needed for a platform that will fly another fifteen years, and nobody will tool up for twelve units without design data.
• Failure analysis. Boards are failing in the field and nobody has a netlist to trace against, so the failure can’t be localized.

Those are legitimate engineering needs and they set the tone for everything else here. You should hold the rights to the design or the authority to have it reproduced; we work under NDA and we don’t take work aimed at copying someone else’s product for competitive sale.

What actually happens to a defense board, in order

Defense hardware differs from commercial hardware in ways that show up early in the process, so the sequence matters.

1. Intake and non-destructive documentation

The board gets photographed at high resolution on both sides before anything is touched, then measured — outline, mounting hole positions, connector datum, thickness, and copper weight where we can get at it. On a defense board this step is longer than usual because there is often a wire mod, a rework jumper, or an ECO-added component that is part of the actual configuration. Those get recorded as-found, not silently cleaned up. If your unit is the only one in existence, this record is the insurance policy.

2. Coating and potting removal

Conformal coating is the norm on military assemblies, and the type dictates the method. Acrylic comes off with solvent fairly cooperatively. Silicone and urethane are stubborn, and parylene is worse — it usually has to come off thermally and mechanically, slowly, under a scope. Potted modules are the hardest case: the encapsulant is often filled and abrasive, and removal risks the very parts we’re trying to identify. This step is the single biggest schedule variable on defense work, and we quote it as a range rather than a fixed number of days.

3. Component identification

Military part numbers are their own puzzle. You’ll see SMD 5962-xxxxx slash sheets, JANTX and JANTXV diodes, MIL-PRF-38534 hybrids, and vendor house numbers that map to nothing public. The engineer works from the marking, the package, the pinout as measured on the board, and the surrounding circuit function. Where the marking is scrubbed or the part is a custom hybrid, we say so explicitly in the BOM rather than guessing a substitute. Radiation-hardened and screened parts get flagged, because a commercial equivalent is not an equivalent in your qualification file.

4. X-ray, then layer separation

X-ray shows internal vias, buried plane structure, and what’s under BGAs and metal shields before we commit to destructive work. After that, layers come off one at a time — controlled etch and mechanical delamination on a sacrificial unit, each layer scanned at high resolution and registered to the drill pattern. Inner layers on a defense board are often mostly plane with careful splits and stitching for EMI control, and those splits matter to function. They get captured as drawn, not simplified.

5. Netlist, schematic, and verification

The scanned layers become a copper database, the database becomes a netlist, and the netlist becomes a schematic drawn in functional blocks rather than as a rat’s nest that happens to be electrically correct. Then it gets checked backward: every net on the recovered schematic is verified against continuity measured on the physical board, pin to pin. Discrepancies get resolved on the bench, not in the drawing. Stackup, dielectric thickness, and trace geometry are recorded so impedance-controlled nets can be reproduced, and acceptability language follows the familiar IPC framework — IPC-6012 class and IPC-A-600 for what the finished bare board has to look like, IPC-2221 rules for anything that has to be re-laid out.

What drives the price on defense PCB reverse engineering

We don’t publish a number, because the same layer count can differ by a factor of several depending on the items below. Here is what the quote is built from.

That last row is worth dwelling on. Layer separation consumes a board. If you can send two, one becomes the sacrificial sample and one stays intact for verification — that is faster, cheaper, and lower risk than any technique we can apply to a single unit. If only one exists, we can still work, but we push X-ray and non-destructive imaging much harder first, and the schedule stretches.

How long a defense board takes

Turnaround is best thought of in three chunks that stack: preparation, copper recovery, and drafting plus verification. Preparation is where defense work diverges from commercial work, because coating removal is unpredictable in a way etching is not.

A clean, uncoated two-layer analog card with a modest parts count is a short job — days, not weeks. A four-layer board with a couple of BGAs and acrylic coating lands in the range of a week or two, since inner layers have to be imaged and registered separately. Dense multilayer digital boards, boards under parylene, and anything potted move into multiple weeks. If firmware recovery is part of the scope, that runs as a parallel track with its own feasibility question, and it can become the critical path.

Two things shorten the schedule more than anything we can do on our side: sending a second sample, and telling us up front which deliverables you actually need. A team that needs Gerber and BOM to get spares fabricated doesn’t need a fully drafted hierarchical schematic, and asking for it anyway adds real days. If you want a sense of how layer count alone moves the number, our breakdowns for 4 layer PCB reverse engineering and 10 layer boards spell out the difference.

What to send us, and what comes back

You can get a real feasibility answer from photographs. Send this:

1. Sharp photos of both sides, whole board in frame, on a dark non-reflective background, plus close-ups of any large or unmarked ICs.
2. Board outline dimensions and thickness, and layer count if you know it.
3. The markings on the main processor or any programmable part, transcribed exactly, including date and lot codes.
4. Whether the board is coated or potted, and with what if you know.
5. One line on deliverables: Gerber only, Gerber plus BOM, full schematic, or a built and tested article.
6. Whether you can supply more than one sample.

What comes back is a feasibility assessment — including anything we think we can’t fully recover — a lead time, and a price. No charge for that assessment. Do not strip coating yourself before shipping, and don’t desolder parts to read markings; both destroy information we need. Ship in ESD packaging with the board mechanically supported so nothing flexes in transit.

Honest limits on defense work

Some of this is harder than the marketing on competing pages will admit.

Custom silicon. If the board’s function lives inside a program-specific ASIC or a MIL-PRF-38534 hybrid, we can recover the board and its interconnect, but not the internals of that device. You will still need that part, or a functional redesign of what it did.

Antifuse PLDs. Older radiation-tolerant designs often use antifuse programmable logic. That technology is one-time and genuinely hostile to readout. Treat recovery of its configuration as unlikely and plan a re-implementation from the surrounding circuit behavior instead.

Locked microcontrollers. Feasibility depends entirely on the specific part and its protection state — an STM32 at RDP Level 1 is a different conversation from RDP Level 2, an MSP430 with the JTAG fuse blown is different from one with only a BSL password, and 8051-family lock bits vary by vendor. We will tell you which category your part falls in before you commit. Nobody honest guarantees any particular chip.

Buried passives and internal shielding. Embedded resistors and internal shield layers can be recovered geometrically but their exact process parameters may not be reproducible with a standard fab.

Regulatory reality. Some defense hardware is

Related reading

• Oct 2026ATSAM3 Crack | Protection Levels & Firmware Recovery
• Oct 2026NXP IC Unlock | Families We Can Read & Recovery
• Oct 2026ATSAM3 Unlock | Feasibility, Cost & Lead Time