Security and Surveillance PCB Copy: Cost and Lead Time

A security and surveillance PCB copy is usually quoted in two parts: the board work (layer separation, netlist, Gerber, BOM) and the firmware work, if the MCU or SoC holds code you no longer have. For a two-layer alarm panel or door controller, the board side is typically a matter of days. A six- or eight-layer NVR mainboard with a BGA SoC and DDR takes meaningfully longer, and the firmware question is what usually drives the schedule.

This page is written for the person holding the dead board — a maintenance engineer keeping a camera fleet alive, or a product owner whose layout files walked out the door with a former contractor.

What drives the price on a surveillance board

Nobody can quote this class of board from a description alone, but the variables are predictable. Security hardware sits across a wide range: a two-layer PIR motion sensor and a ten-layer 32-channel NVR are the same service in name only.

• Layer count and stackup. Each internal layer has to be exposed and imaged separately. Two layers is straightforward optical work. Six or more, especially with blind or buried vias, multiplies the effort.
• BGA and fine-pitch parts. The SoC on an IP camera board (Hisilicon-class, Ambarella-class) is a BGA with hundreds of balls. Tracing those nets means X-ray, controlled removal, and pad-by-pad verification instead of a photo.
• Component count and density. A 16-channel DVR board with dozens of 0402 passives, four Ethernet magnetics, and a video decoder array takes far more identification time than a keypad board.
• RF sections. Wireless alarm panels, 433 MHz receivers, Wi-Fi camera modules. Impedance-controlled traces and matching networks have to be measured, not guessed, or the radio simply won’t perform.
• Firmware involvement. Board files alone are cheaper. Add MCU code extraction and the price and lead time both move.
• Deliverable set. Gerber plus BOM is one tier. Gerber plus BOM plus a full readable schematic plus a working assembled prototype is another.
• Power stage copper weight. PoE boards and 12 V camera supplies often use heavier copper on the input side, which changes the etching and the stackup reconstruction.

Rather than quote a number we’d have to walk back, we price against the actual board. Send photos and we’ll tell you which of the above applies to yours.

How long each class of board actually takes

Lead time on a security and surveillance PCB copy tracks the same variables as cost, plus one more: whether the board arrives working or dead. A functioning sample lets us verify continuity against a live circuit and run a comparison test at the end. A board with a blown power stage means we reconstruct from copper alone and validate more slowly.

Two things stretch a schedule more than layer count. First, potting — some outdoor camera boards and tamper-protected alarm modules arrive under epoxy, and removal without lifting pads is slow, careful work. Second, obsolete parts. If the video decoder or the SoC is end-of-life, sourcing a verified equivalent becomes its own task before any prototype can be built.

Where firmware fits in the schedule

The board work and the firmware work run in parallel where possible, but firmware sets the floor on delivery. If the panel MCU is a locked 8-bit part, feasibility is usually known quickly. If it’s a modern ARM device with read protection engaged at the highest level, assessment itself takes time and the answer may be no.

Alarm panels and access controllers lean heavily on 8-bit and mid-range parts — 8051 derivatives, PIC18F, AVR, Nuvoton N76E. Camera and NVR boards run Linux from external SPI NOR flash, which is a different job: the flash contents are readable, and the work shifts to dumping and verifying the image rather than defeating an on-chip lock.

What we need from you before quoting

Most quote delays come from incomplete first messages. Send this and you’ll get a real answer, not a request for more information:

1. Clear photos of both sides, whole board in frame, laid on a dark non-reflective surface, sharp enough to read the silkscreen. No angled shots, no flash glare across the solder mask.
2. Board dimensions in mm, and the layer count if you know it.
3. The main chip markings — a close-up of the MCU or SoC top marking, plus any flash or EEPROM package nearby. If a part number is sanded off, tell us.
4. One line on deliverables. Gerber only? Gerber plus schematic? Firmware too? Assembled prototypes?
5. Quantity, if you know it. Five spares for a repair job and 2,000 units of production drive different decisions about component substitution.

You get back three things: a feasibility read (including any part of the board we think will be a problem), a lead time, and a price. If we think the honest answer is “redesign this section instead of copying it,” we’ll say so.

What the engineer is actually doing to your board

Order matters here, and knowing the order tells you why certain boards cost more.

The board is photographed and measured intact first, both sides, with outline and mounting-hole positions recorded. Then components are documented in place — position, orientation, marking — because once desoldering starts, that information is gone. Anything unreadable gets pulled and measured: capacitors on an LCR meter, inductors, the odd unmarked SOT-23.

Next, X-ray on anything with hidden connections, which on surveillance boards means the SoC BGA, the DDR package, and often the Ethernet magnetics. Then layer separation: the outer copper is imaged, the board is delaminated layer by layer, and each internal layer is scanned. Every layer gets aligned to a common set of features so vias line up.

Copper is vectorized into a working layout, then the netlist is pulled from that layout and checked back against continuity measurements on the original board. That check is the whole job. If a net in the file disagrees with a beeping meter on the physical board, the file is wrong, and we fix it before anything is fabricated.

Fabrication follows IPC-A-600 and IPC-6012 acceptability for the bare board. Where we have to re-derive trace widths for a power section, IPC-2152 current-carrying data is the reference rather than eyeballing the original.

Verification, not just delivery

The first article is compared against the original: continuity on a defined net list, dimensional check, then a powered functional test where the board’s function allows one. On a camera board that means confirming a video stream and Ethernet link. On an access controller, exercising the relay outputs and reader interface. We tell you what we tested — not “fully tested.”

Honest limits on security and surveillance boards

This category has specific hard spots, and pretending otherwise wastes your money.

Secure elements are usually out of scope. Some access control readers and payment-adjacent security hardware include a dedicated secure IC or crypto element. Those parts are designed to resist exactly what this service does, and we don’t promise to read them.

Paired and provisioned devices. A cloned camera board can be electrically identical and still refuse to work if the original firmware binds to a per-unit key, a MAC-derived license, or a cloud provisioning record. That’s a systems problem, not a layout problem, and it needs discussing before you commit.

Highest read-protection settings. On STM32-family parts, RDP Level 1 and RDP Level 2 are very different situations, and Level 2 is a genuine dead end in many cases. Same story with a burned JTAG fuse on MSP430 or an aggressively set lock-bit configuration on older 8-bit devices.

Physically damaged samples. A board that’s been through a lightning strike on the PoE line often has lifted pads and vaporized traces. We can still recover the layout, but the missing information has to be inferred, and inference takes longer and carries more risk.

Undocumented FPGA or CPLD configuration. Some multi-channel DVR designs use a CPLD for video muxing. The copper is recoverable; the bitstream may not be.

On the legal side: we work on the assumption that you hold the rights to the design or are authorized to maintain it, and every project runs under NDA. Legitimate reasons cover most of what lands on our bench — recovering firmware you own but lost, keeping discontinued surveillance equipment in service, migrating off an obsolete video decoder, and failure analysis after a field return.

FAQ

Can you copy a DVR board without the schematic?

Yes — no schematic is needed, only the physical board. The layout is recovered from the copper itself and the netlist is verified against continuity measurements on your sample. A schematic, if you happen to have a partial one, speeds up review and reduces questions, but it isn’t a requirement for any board class we handle.

How much does a security and surveillance PCB copy cost?

It depends on layer count, BGA presence, component count, RF sections, and whether firmware is included. A two-layer alarm panel sits at the low end of our range; a multilayer NVR mainboard with a large SoC sits well above it. Send photos, dimensions, and chip markings and we’ll price the actual board rather than a category.

Can you get the firmware out of an IP camera board?

Related reading

• Oct 2026Rohm IC Unlock | Which Families We Can Read
• Oct 2026Maxim IC Unlock | Families We Can Read & Recover
• Oct 2026Dialog IC Unlock | Families We Can Read & Recover