The PCB reverse engineering process turns a physical board back into design data: high-resolution scans, layer-by-layer copper imaging, a netlist, a component-identified BOM, a readable schematic, and Gerbers you can send to a fab. It runs in a fixed order because each stage checks the one before it. Below is what actually happens to your board, bench step by bench step, and what we need from you to start.
Stage 1: Intake, documentation, and a feasibility read
Before anything touches the board, it gets photographed and measured as received. Outline dimensions, board thickness, hole positions, connector locations, mounting hardware, any conformal coating or potting, any burn marks or prior rework. If a board arrives with a blown FET and lifted pad, we want that on record — otherwise nobody can tell later whether the damage was pre-existing or ours.
Then an engineer does a feasibility read. That means looking for the things that change the schedule: fine-pitch BGAs, blind and buried vias, sanded-off part markings, custom ASICs, potting compound, and whether the board appears to be four layers or ten. This read is what generates a real quote instead of a guess, and it’s why we ask for the board itself or very good photos rather than a vague description.
What to send us
- Photos of both sides, whole board in frame, shot flat on a dark background so the edges and silkscreen read clearly.
- Board dimensions — length, width, and thickness if you can measure it.
- Close-ups of the main chip markings, especially the MCU, any custom-labeled parts, and anything with a house number.
- One line on deliverables: do you need a schematic for repair, Gerbers for a rebuild, or both plus BOM?
- Quantity, if you plan to build. One repair board and a 5,000-unit production run lead to different decisions at the layout stage.
What comes back from us is short: feasibility yes/no/conditional, an expected lead time, and a price. If something on the board makes us uncertain, we say so at that point rather than three weeks in.
Stage 2: Component identification and BOM capture
Every part on the board gets located, oriented, and identified. Passives are measured or read from markings; measuring a 0402 in circuit is unreliable, so borderline values usually get confirmed after desoldering. Actives are read from top marking and package, then cross-checked against the pinout the traces actually imply. If a chip is marked as a comparator but the copper says op-amp topology, one of the two is wrong and we settle it before moving on.
Three things reliably slow this stage down: laser-marked parts that have faded, deliberately sanded or overprinted markings, and obsolete parts whose datasheets are hard to source. Custom or programmed logic — a masked micro, a locked CPLD, a house-numbered power controller — sometimes cannot be identified from the outside at all, and needs decapsulation or die-level work to resolve. That is a separate scope, and we quote it separately.
The output is a BOM with reference designators, values, tolerances where they matter, packages, and manufacturer part numbers with notes on anything that is end-of-life. If a part is gone from the market, we flag a form-fit-function alternate rather than leaving you a dead line item.
Stage 3: Scanning and layer separation
Both outer layers get scanned at high resolution, aligned to a common origin so the top and bottom images register to each other within a couple of thousandths of an inch. Registration matters more than raw DPI here — a beautiful scan that’s rotated half a degree will put every via slightly off and poison the netlist downstream.
For a two-layer board that’s most of the imaging done. For multilayer boards, the inner layers have to be exposed. That means controlled removal of copper and dielectric layer by layer, scanning after each pass, or on some jobs a combination of X-ray imaging and mechanical sectioning to establish via structure before any material comes off. It is destructive to that sample. This is the single biggest reason a four-layer board takes meaningfully longer than a two-layer one, and a twelve-layer HDI board with stacked microvias longer again.
Blind and buried vias are the honest complication. A through-hole via is visible from both sides, so you know its layer span. A buried via that connects only layers 4 and 5 shows up nowhere on the outer surfaces, and its span has to be established from imaging before delamination, not inferred afterward. Boards with heavy internal power planes, thick copper, or unusual laminate stacks also take extra care during separation because the layers don’t part cleanly.
Stage 4: Netlist extraction and continuity verification
Now the copper becomes connectivity. Each layer image is traced into polygons, vias tie the layers together, pads map to component pins, and the result is a netlist: every node on the board and every pin on it. This is the point where the PCB reverse engineering process stops being image processing and starts being electrical engineering.
Then it gets checked against physical reality. We probe the original board with a meter — continuity on the nets that matter, resistance and diode checks on the ones where a plane or a zero-ohm link could hide a mistake. Power and ground nets get particular attention, because a plane that’s split into two isolated pours reads as one net to careless tracing and will produce a board that doesn’t work. High-pin-count nets, buses, and anything crossing a connector get verified pin by pin.
Discrepancies between the traced netlist and the probed board are resolved before the schematic is drawn, not after. In practice, that verification loop is what separates a usable reverse-engineered design package from a pretty set of files nobody can build from.
Stage 5: Schematic capture that a human can read
A netlist is machine-correct and human-useless. Turning it into a schematic means recognizing function: this cluster is a buck converter, that string is an RS-485 transceiver with its bias network, this block is the MCU with its decoupling and crystal. Parts get grouped by circuit function, power rails get labeled, signal flow runs left to right, and pages get split along functional boundaries rather than wherever the page filled up.
Reference designators are kept identical to the silkscreen on the original board. That single decision is what makes the schematic usable for field repair — a technician reading “C47 open” can find C47 on the physical assembly.
We also annotate what we inferred versus what we measured. If a resistor was destroyed and its value was reconstructed from the divider ratio around it, that’s a note on the sheet. If a component was depopulated in the original build, the footprint is on the schematic marked NP rather than silently dropped.
Stage 6: Layout data, Gerbers, and what gets built
From verified layers and a verified netlist we rebuild the layout as a real CAD database, not a bitmap trace-over. Pads and footprints are dimensioned from measurements, drill sizes are binned to real tool sizes, and the stackup is documented with measured dielectric thicknesses so a fab can hit the same impedance on controlled-impedance nets. Deliverables normally include Gerber X2 or RS-274X, an Excellon drill file, netlist, BOM, pick-and-place data, and the native CAD project.
The last check is a DRC pass against the fab’s capability and a comparison of the rebuilt layout back against the original scans, overlay on overlay. Design rules follow the IPC-2221 family for spacing and IPC-2152 where trace current and thermal rise need justifying; board acceptance on the fabricated result is judged against IPC-A-600 and IPC-6012 class as agreed for the job. If you’re weighing whether you want a straight duplicate or a documented design you can modify, the distinction between copying a board and reverse engineering it decides which deliverables you should be paying for.
Deliverable tiers by what you’re trying to do
| You need to | Minimum deliverable set | What drives the effort |
|---|---|---|
| Repair a dead board in the field | Schematic + BOM + test points | Component ID quality, silkscreen legibility |
| Rebuild identical boards | Gerbers + drill + BOM + pick-and-place | Layer count, via structure, stackup accuracy |
| Modify or re-spin the design | Native CAD + schematic + netlist + BOM | Schematic readability, functional annotation |
| Replace an obsolete part | Schematic + BOM with alternates + affected layout | Availability research, footprint and timing differences |
What makes a board hard, and what we sometimes can’t do
Straight talk, because it saves everyone time:
- Potted and epoxy-encapsulated assemblies. Removing the compound without destroying the traces underneath is sometimes possible and sometimes not. It depends entirely on the compound.
- One-of-a-kind boards. Inner-layer separation consumes the sample. If you have exactly one board and it must survive, we’re limited to non-destructive methods, which means less certainty on inner layers.
- Programmable logic and locked microcontrollers. Recovering the copper does not recover the code. Firmware is a separate engineering question with its own feasibility answer, and outcomes vary widely by part family and protection level.
- Heavily damaged boards. Burned regions destroy the very information we need. Sometimes a second, working sample solves it; sometimes the values have to be reconstructed from circuit analysis and labeled as such.
- RF and high-speed sections. Copying geometry is straightforward; matching performance requires the same laminate, and if the original material is no longer made, the design needs re-tuning rather than duplication.
Cost tracks these same variables — layer count, board area, component count, BGA presence, whether firmware is in scope, and how many deliverables you need. That’s why quotes are per-board rather than per-square-inch, and why a look at what drives reverse engineering pricing and lead time is more useful to you than a headline number.
On rights: we work on boards you own or are authorized to work on, you hold responsibility for the intellectual property position and applic
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote