Reverse engineering cost is driven by engineering hours, not by the size of your purchase order. Six things move the number: layer count, board area and component density, whether there are BGAs or blind/buried vias, how many deliverables you want, whether the parts are still available, and whether firmware is involved. A two-layer analog board with 40 through-hole parts is a small job. A ten-layer controller with three BGAs and a locked MCU is a different animal entirely.
This page is for the person collecting quotes and trying to figure out why two labs came back with numbers that differ by a factor of four. Usually they quoted different scopes.
The six variables that set the price
When we look at your photos, we’re estimating hours in five buckets: intake and imaging, layer separation, net tracing and verification, component identification, and file generation. Everything below changes how many hours land in those buckets.
1. Layer count
This is the biggest single driver, and it isn’t linear. Outer layers can be photographed and scanned directly. Inner layers have to be exposed one at a time — controlled grinding or chemical delamination, image each plane, then align every image to a common reference so via positions line up across the stack. A six-layer board isn’t three times a two-layer board; it’s more, because alignment error compounds and every added plane has to be cross-checked against the ones above and below it.
2. Board area and component count
Net tracing scales with copper, not with dollars. A 300 mm × 200 mm backplane with mostly wide power routing can be cheaper per square centimeter than a 40 mm × 40 mm module packed with 0402s and a QFN under a shield can. What we actually count is nets and pins, not board outline.
3. BGAs, fine pitch, and buried vias
A BGA hides its own escape routing. You can’t probe it from the surface, so ball assignments come out of X-ray imaging plus inner-layer work, then get confirmed against the datasheet pinout. Blind and buried vias add another problem: a via that starts on layer 3 and dies on layer 5 is invisible from either face, so the stack-up itself has to be reconstructed before net tracing is trustworthy. If your board has any of these, expect the quote to reflect it. If a lab quotes a BGA board at the same rate as a two-layer power supply, they haven’t looked at the photos.
4. Which deliverables you actually need
This is where quotes diverge most, and where you have the most control. Gerber and drill data alone is the cheapest useful output — enough to fabricate bare boards. A netlist costs more. A readable, hierarchical schematic with proper reference designators and functional blocks costs more again, because it requires an engineer to understand the circuit, not just record connectivity. Editable CAD source and a manufacturing-ready deliverable package sit at the top.
| Deliverable | What it lets you do | Relative cost |
|---|---|---|
| Gerber + drill files | Fabricate identical bare boards | Lowest |
| Gerber + BOM + pick-and-place | Fabricate and assemble | Low to moderate |
| Netlist | Verify connectivity, feed a CAD import | Moderate |
| Full schematic | Troubleshoot, modify, redesign, train staff | Higher |
| Editable CAD project (schematic + layout) | Change the design, re-spin, re-panelize | Highest |
5. Component availability
Identifying a part is one job. Finding a drop-in for a part that went end-of-life in 2011 is another. Sanded, relabeled, or house-numbered chips mean we work from package, pin count, surrounding circuitry, and behavior in-circuit — that’s investigative time. If you need functional replacements sourced and validated rather than just named, say so up front; it belongs in the quote, not in a surprise later.
6. Firmware
Board work and firmware work price separately. If the MCU on your board is programmed and locked, recovering that code is its own project with its own feasibility question. An old 8051-family part with simple lock bits is not the same problem as an STM32 sitting at RDP Level 2, or an MSP430 with the JTAG fuse blown. Same board, wildly different firmware line item.
Why layer count costs what it does
Here’s the concrete version. On a four-layer board, layers 1 and 4 are visible. Layer 2 is usually a ground plane and layer 3 is usually power with signal routing squeezed in. To get layer 2 and 3 imaged, we remove copper and dielectric above them in controlled passes, scan at high resolution, then register those scans against drilled hole positions so the vias in the layer-2 image sit exactly where they sit in the layer-1 image.
Every registration step is a chance to introduce error, and every error has to be caught by verification rather than by hope. That’s why our step-by-step process for reverse engineering a board puts continuity checking after net extraction, not before. We buzz out a sample of nets on the physical board with a meter and compare against the extracted netlist. Discrepancies get traced back to the image, not patched in the file.
Trace geometry matters too. We measure trace width and copper thickness rather than assume them, because a 3 mm trace carrying motor current is a deliberate choice — IPC-2152 gives you the current-versus-width relationship, and if we redraw it thinner the board fails in the field, not in the lab. Same reasoning applies to clearances and annular rings, where IPC-2221 and the IPC-A-600 acceptability criteria give us a sane baseline to sanity-check against.
What to send for a quote, and what comes back
We can’t price a board we can’t see. Send this and you’ll get a real number instead of a range:
- Clear photos of both sides, whole board in frame, shot on a dark non-reflective background with even light. No flash glare on the solder mask.
- Board dimensions in mm, plus overall thickness if you can measure it with calipers.
- Layer count if you know it. If you don’t, say so — we’ll estimate from the photos and confirm with a cross-section or X-ray.
- The main chip markings, in a close-up sharp enough to read. Full part number, including the suffix.
- One line on deliverables: “Gerber only,” or “Gerber plus BOM,” or “schematic so we can modify the design,” or “we need the firmware too.”
- Quantity and end use, if you plan to build. It changes whether we optimize for exact replication or for manufacturability.
What you get back: a feasibility assessment that names the risky parts of your specific board, a lead time, and a price broken out by deliverable so you can drop items you don’t need. If we think something is questionable — an unreadable chip, a potted section, a locked MCU we can’t commit to — it’s in the reply, not buried in a caveat. Projects run under NDA, and you’re responsible for holding the rights to the design you send us.
Where reverse engineering gets expensive or stops being feasible
Honest constraints, because the number changes when these show up:
- Epoxy potting or conformal coating over the whole assembly. Removal is slow and sometimes damages fine-pitch pads. Sending two units helps.
- Sanded or house-numbered ICs. Identification becomes inference. Sometimes conclusive, sometimes we can only narrow it to a family.
- HDI with stacked microvias. Delamination has to be far more controlled, and the layer count is often higher than it looks from outside.
- Flex and rigid-flex. The substrate doesn’t survive grinding the way FR-4 does. Different technique, more time.
- Fire or corrosion damage. Missing copper can’t be recovered from a burned area. We reconstruct from the intact side and from circuit logic, and we tell you which nets are inferred rather than observed.
- Programmable logic. CPLD and FPGA configuration is not board work at all. Sometimes recoverable, often not, and never something to assume.
- A single board with no spare. Layer separation is destructive. If you have exactly one unit and it’s still working, that’s a real constraint on how we proceed and it should be discussed before anything gets ground.
None of these mean “no.” They mean the quote goes up and the feasibility answer gets more specific. We’d rather say “layers 4 and 5 in this corner will be partly inferred” than promise perfection and hand you a file that doesn’t build.
Comparing quotes without getting burned
A cheap quote and an expensive quote for the same board usually differ in verification. Anyone can trace a board once and export Gerbers. The cost sits in the second pass — continuity verification against the physical unit, BOM cross-check against manufacturer datasheets, and building a prototype to confirm the files produce a working assembly.
Questions worth asking any lab, including us:
- Is verification included, or is it a separate line?
- Do I get editable CAD source, or only output files?
- Who owns the files afterward, and are they deleted from your systems on request?
- If the built prototype doesn’t work, what happens?
- What specifically on my board are you unsure about?
The last question is the useful one. A lab that names two or three uncertainties on your particular board has actually looked at it. A lab that says everything is straightforward hasn’t.
FAQ
How much does reverse engineering cost for a four-layer board?
It depends mostly on component density and deliverables, so we quote per board rather than by layer count alone. A sparse four-layer control board with Gerber-only output is toward the low end. The same layer count with two BGAs, 600 components, and a full schematic can be several times that. Send photos and dimensions and you’ll get a firm number rather than a range.
Can I lower the reverse engineering cost?
Yes, in three ways. Order only the deliverables you’ll use — if you just need boards f
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote