PCB Reverse Engineering Case Study: 6 Boards Recovered

Why a PCB Reverse Engineering Case Study Matters More Than a Price List

Every board is different. A four-layer industrial controller and a twelve-layer HDI smartphone mainboard sit at opposite ends of the complexity spectrum, yet both land in our inbox with the same question: “How much will this cost, and how long will it take?”

A generic price table can give you a range, but a detailed PCB reverse engineering case study shows you exactly where the hours go—imaging, net tracing, firmware recovery, component sourcing, validation. Below we walk through six real projects, each from a different industry, and lay out the timeline, the budget, and the lessons learned. Use them to estimate your own project before you request a quote with your board details.

How We Measure “Cost” in These Case Studies

Before diving in, a quick note on methodology. Every PCB reverse engineering case study below reports two cost dimensions:

• Engineering hours – the labor our team invested in imaging, schematic extraction, layout reconstruction, firmware work, and validation.
• Calendar days – wall-clock time from receiving the sample board to delivering verified Gerber files, BOM, and (where applicable) firmware.

Material costs (X-ray sessions, cross-section consumables, prototype fab runs) are folded into the totals. Component procurement for the validation build is listed separately because it varies with market conditions. If you want to understand the general factors that drive pricing, our guide on honest limits of PCB reverse engineering by board type is a good companion read.

Case Study 1: ATM Main Control Board – Legacy Fleet Rescue

The Situation

A bank operating 1,200 ATMs across Southeast Asia faced end-of-life on its main control board. The OEM had discontinued the model, and aftermarket stock was drying up. Each failed unit meant a machine offline and lost revenue.

Board Profile

Work Breakdown

1. Optical and X-ray imaging (Day 1–2): High-resolution scans of all six layers, plus X-ray for BGA pad mapping.
2. Net extraction and schematic rebuild (Day 3–9): 480 components meant roughly 1,800 nets. Our engineers traced every connection and rebuilt the schematic from the recovered netlist.
3. Firmware recovery (Day 5–11): The ARM9 SoC carried read-out protection. Our protected microcontroller firmware recovery team used a glitching approach to extract the binary without destroying the chip.
4. Layout reconstruction and DRC (Day 10–14): Gerber files regenerated, design-rule checks run against the original stackup.
5. Prototype fab and validation (Day 15–22): Two prototype units built, inserted into a test ATM, and run through the bank’s transaction suite.

Results

The bank went on to produce 300 replacement boards in the first batch, at a per-unit cost roughly 40 % below the last aftermarket quote. For the full technical narrative, see the ATM main control board clone case study.

Case Study 2: Smartphone Mainboard – HDI Stackup Reconstruction

The Situation

A regional handset brand needed to replicate a competitor’s mainboard layout to study signal-integrity choices for its own next-generation design. The board used a 10-layer HDI stackup with stacked microvias and 0201 passives.

Board Profile

Work Breakdown

1. Cross-section and delayering (Day 1–4): Chemical delayering exposed each copper layer. Stacked microvias required careful sequential imaging to map via-in-pad connections.
2. High-resolution photography and stitching (Day 2–6): Each layer photographed at 2,400 DPI equivalent, stitched into a single composite image.
3. Net extraction (Day 5–14): Over 3,200 nets traced across ten layers. The PoP package alone contributed 600+ connections.
4. Stackup characterization (Day 7–10): Impedance targets reverse-calculated from trace widths, dielectric thicknesses measured via micrograph.
5. Layout file delivery (Day 15–19): Full ODB++ dataset with layer assignments, impedance annotations, and BOM.

Results

HDI boards are the most labor-intensive category we handle. The full write-up on handset mainboard HDI stackup reconstruction explains the imaging and via-mapping process in depth.

Case Study 3: MRI Console Board – Medical Documentation Rules

The Situation

A hospital group needed replacement console boards for an MRI scanner whose manufacturer had been acquired and no longer supported the model. Regulatory traceability was non-negotiable: every design file had to carry a documented change history.

Board Profile

Work Breakdown

1. Incoming inspection and documentation setup (Day 1): Photographs, serial numbers, and a change-control log initialized per the hospital’s QMS template.
2. Imaging and net extraction (Day 2–10): Eight-layer board with wide ground planes and sensitive analog routing. Special attention to ADC reference traces.
3. Schematic rebuild with annotation (Day 8–15): Every net labeled with functional block names (gradient driver, RF receive chain, etc.) to satisfy the hospital’s documentation audit.
4. Component equivalence review (Day 12–18): Three ICs were obsolete. Cross-reference sheets prepared with pin-compatible replacements and datasheet excerpts.
5. Prototype and functional test (Day 19–28): Board inserted into the scanner and run through a phantom imaging sequence.

Results

Medical projects always take longer because of the documentation overhead, but the alternative—a $2 M scanner sitting idle—makes the investment trivial. More detail is available in the MRI console board recovery case study.

Case Study 4: Aviation Autopilot Board – Legacy Equipment

The Situation

An MRO shop maintaining a fleet of regional turboprops needed autopilot boards that had been out of production for over a decade. No schematics, no Gerbers, and the original manufacturer had gone through two ownership changes.

Board Profile

Work Breakdown

1. Imaging (Day 1–2): Four-layer board with conformal coating. Coating removed chemically before scanning.
2. Net extraction and schematic (Day 3–8): Relatively low component count, but MIL-spec parts required careful cross-referencing to current-production equivalents.
3. Firmware dump (Day 3): OTP EPROM read on a standard programmer in under an hour.
4. Layout and Gerber generation (Day 9–12): Original trace widths preserved exactly; aviation boards must not introduce impedance changes.
5. Prototype and bench test (Day 13–18): Servo response curves compared against a known-good unit.

Results

This was one of our faster projects thanks to the low layer count and accessible firmware. The aviation autopilot board recovery case study covers the conformal-coating removal and MIL-spec substitution process.

Case Study 5: Face-Recognition Terminal – Component Substitution

The Situation

A security integrator had deployed 5,000 face-recognition attendance terminals across corporate campuses. The original Chinese-market board used a camera module and an AI accelerator chip that were both hit by supply-chain disruptions. The integrator needed a redesigned board that accepted available alternatives without changing the enclosure or firmware API.

Board Profile

Work Breakdown

1. Imaging and net extraction (Day 1–7): Standard six-layer workflow.
2. Schematic with functional annotation (Day 5–11): AI accelerator data bus, DDR4 routing, and camera MIPI lanes all documented.
3. Component substitution engineering (Day 8–15): Replacement AI SoC had a different BGA pinout. Layout modified to accommodate new fanout while keeping the same board outline and mounting holes.
4. Firmware adaptation (Day 12–18): Device-tree modifications for the new camera module; regression testing of the recognition algorithm.
5. Prototype and field trial (Day 19–26): Five units deployed on-site for a two-week soak test.

Results

Component substitution adds significant engineering time compared to a straight copy, but it was the only path forward given the supply situation. The detailed narrative is in the face-recognition terminal board copy and substitution case study.

Case Study 6: High-Frequency Power Supply – Magnetics Rebuild

The Situation

A telecom equipment maker needed to replicate a 48 V-to-3.3 V high-frequency switching power supply module used inside a base-station chassis. The module included custom-wound transformers and inductors with no published specifications.

Board Profile

Work Breakdown

1. Imaging (Day 1): Compact four-layer board scanned quickly.
2. Net extraction and schematic (Day 2–5): Low component count, but high-current traces required accurate width and spacing capture.
3. Magnetics characterization (Day 3–8): Custom transformer disassembled. Turns ratio, core material (measured via impedance analyzer), and winding technique documented. Inductor similarly characterized.
4. Layout and thermal simulation (Day 6–10): 2 oz copper planes modeled for thermal performance under full load.
5. Prototype and load test (Day 11–16): Efficiency, ripple, and thermal rise measured at 25 °C and 55 °C ambient.

Results

The magnetics rebuild was the most specialized step. Without it, the clone would have different efficiency and EMI characteristics. Full details in the high-frequency power supply board copy with magnetics rebuild write-up.

Side-by-Side Comparison: All Six Case Studies

The table below lets you compare every PCB reverse engineering case study at a glance. Use it to find the project closest to your own board and set realistic expectations.

Patterns You Can Use to Estimate Your Own Project

After hundreds of projects, a few rules of thumb emerge from every PCB reverse engineering case study we publish:

• Layer count is the strongest cost predictor. Each additional pair of layers adds roughly 15–25 % to imaging and net-extraction time.
• Firmware protection can double the timeline. An unprotected EPROM takes an hour; a glitch-attack on a locked ARM SoC can take a week.
• Regulatory documentation adds 20–35 % overhead. Medical, aviation, and automotive projects require traceable change logs that pure-engineering projects skip.
• Component substitution is not free. Swapping even one BGA IC can cascade into layout changes, impedance re-tuning, and firmware patches.
• Small boards are not always cheap. The power-supply module had only 140 components, but the magnetics rebuild demanded specialized equipment and expertise.

If you are still unsure whether your board can be reverse-engineered at all, our frequently asked questions page covers the most common concerns—from encrypted firmware to potted modules.

What to Prepare Before You Send a Board

Every case study above started the same way: the client shipped a sample board along with whatever context they had. To get the fastest turnaround and the most accurate quote, gather the following before reaching out:

• At least one working sample (two is better—one can be sacrificed for delayering).
• Any existing documentation: schematics, BOMs, test procedures, even marketing datasheets.
• A clear statement of the deliverable you need: Gerber files only? Full schematic? Firmware? Prototype validation?
• Quantity forecast—this affects whether we optimize the layout for hand assembly or panel production.

With those items in hand, you can submit your project for a 24-hour quote and receive a preliminary breakdown similar to the tables above.

Final Thoughts

No two boards are the same, but every PCB reverse engineering case study follows a recognizable arc: image, extract, rebuild, validate. The variables—layer count, component density, firmware protection, regulatory burden—determine where on the cost and timeline spectrum your project will land. We hope these six examples give you the concrete benchmarks you need to plan with confidence.

Related reading

• Oct 2026NXP LPC18 Unlock | Feasibility, Cost & Lead Time
• Oct 2026Analog Devices IC Unlock | Families We Can Read
• Oct 2026NXP LPC17 Crack | Protection Levels & Recovery