PCB Reverse Engineering Case Studies | Real Results

PCB Reverse Engineering Case Studies: What Recovery Actually Looks Like

PCB reverse engineering case studies demonstrate how boards move from unknown or undocumented hardware to complete, manufacturable file sets. Each project below is anonymized but drawn from real work — real layer counts, real constraints, real failure points. If you need to understand what a reverse engineering engagement involves before committing budget, these five cases cover the range from straightforward 2-layer clones to complex multilayer recoveries with locked firmware.

Every case follows the same arc: a client has a board they own, no documentation, and a production or maintenance need they cannot meet without files. Our engineers strip, scan, trace, and rebuild. The specifics — stackup, component density, IC protection, turnaround — vary dramatically. That variance is the point of publishing these pcb reverse engineering case studies: no two boards are the same, and blanket promises mean nothing without context.

Case Study 1: 2-Layer Power Supply Controller — Legacy Replacement

Situation

A European repair shop received a batch of failed power supply boards from a discontinued packaging machine. The OEM had ceased operations. No schematic, no Gerber files, no BOM existed. The board was a single-sided-load, 2-layer FR-4 design with through-hole and SMD components — roughly 85 unique parts, 140 placements total.

Constraints

• Board dimensions: 112 × 78 mm, 1.6 mm thickness
• Minimum trace width observed: 10 mil (0.254 mm); minimum spacing: 8 mil
• Three electrolytic capacitors had leaked, obscuring two traces on the bottom copper layer
• Client needed 50 replacement boards within 6 weeks

What We Did

We stripped the board chemically to expose both copper layers cleanly. High-resolution optical scanning at 2400 DPI captured the artwork. The damaged trace segments were reconstructed by cross-referencing the schematic we derived from the netlist — continuity testing confirmed the reconstruction. The full deliverable set included Gerber RS-274X files, an ODB++ archive, a schematic in PDF and editable Altium format, and a BOM with manufacturer part numbers and two alternates per line where the original was obsolete.

Result

Turnaround: 4 working days from board receipt to file delivery. The client’s contract manufacturer produced 50 boards; all passed functional test on first spin. Total project cost fell under $600 — less than one-tenth the cost of a clean-sheet redesign the client had been quoted.

Lesson

Simple boards are not always simple projects. Corrosion and component damage can destroy critical trace data. Having a second reference sample — even a partially working one — cuts reconstruction risk significantly. We recommend clients send at least two boards whenever possible. For more on situations like this, see when reverse engineering beats a full redesign.

Case Study 2: 6-Layer Industrial Motor Drive — Impedance-Controlled Stackup

Situation

A North American industrial automation integrator needed to reproduce a 6-layer motor drive controller board. The original supplier had been acquired, and the new entity refused to share design files. The client owned the IP and had proof of original commissioning. The board carried high-current paths (up to 15 A on two layers), a mixed-signal section with a 12-bit ADC, and impedance-controlled differential pairs for an RS-485 interface.

Constraints

• Board dimensions: 165 × 210 mm, 2.0 mm total stackup
• Layer assignment: signal–ground–power–power–ground–signal
• Differential pair impedance target: 120 Ω ± 10%
• Minimum trace/space on inner layers: 5/5 mil
• BGA footprint (0.8 mm pitch) for the FPGA managing PWM outputs

What We Did

Cross-sectioning confirmed the stackup and dielectric thicknesses (core: 0.36 mm 370HR; prepreg: 0.18 mm 2116). Each layer was photographed after controlled chemical etch-back. We rebuilt the impedance model in a field solver, matching the original 120 Ω differential target within ±3 Ω. The BGA fanout was captured pad-by-pad using X-ray imaging at 5 µm resolution. The full schematic was verified against the client’s operational test procedure — every signal path was confirmed functional.

Deliverables: Gerber files (RS-274X), IPC-2581 stackup report, BOM with 212 line items, schematic (Altium and PDF), and a netlist comparison report showing 100% match to the extracted board.

Result

Turnaround: 11 working days. The client fabricated a prototype run of 5 boards. Four passed all tests immediately; one had a solder defect unrelated to the file set. Production run of 200 units followed. This case is documented alongside five other recoveries in our six-board recovery case study.

Lesson

Impedance-controlled designs require physical cross-sectioning — you cannot guess dielectric constants from photographs. Budget an extra 2–3 days for stackup verification on boards above 4 layers. Clients who can supply the original fab drawing (even a partial one) save time and cost. Learn more about what changes when you copy a multilayer board.

Case Study 3: 4-Layer Medical Device Interface — BOM Obsolescence

Situation

A medical device manufacturer needed to continue producing a patient-monitoring interface board originally designed in 2009. Fourteen of the 97 unique components had gone end-of-life. The client had the original Gerber files but no schematic and no BOM — the design engineer had left the company years earlier.

Constraints

• Board: 4-layer, 89 × 54 mm, 1.0 mm thickness (thin profile for enclosure fit)
• IPC Class 2 required (medical, non-implantable)
• 14 obsolete components, including a voltage regulator and two op-amps
• Firmware on an STM32F103 — read-protection level 1 engaged

What We Did

Since Gerber files already existed, the scope was partial: schematic extraction, BOM recovery with alternates, and firmware recovery. We traced the netlist from the Gerber data, identified every component by markings and circuit function, and built a complete schematic. For the 14 obsolete parts, we sourced pin-compatible, parametrically equivalent replacements — each validated against the original’s datasheet specs for voltage range, thermal rating, and package footprint.

The STM32F103’s Level 1 read protection was addressed through authorized recovery (client provided proof of design ownership and signed our NDA and IP protection agreement). The firmware binary was recovered intact and verified by flashing it onto a new STM32F103 on a test jig. For background on how chip-level protections work, see our explanation of fuses, lock bits, and encryption in MCU security.

Result

Turnaround: 7 working days (3 for schematic/BOM, 4 for firmware). The updated BOM extended the board’s production life by an estimated 8+ years. No Gerber modifications were needed — all replacement components shared the original footprints.

Lesson

Reverse engineering is not always about recreating copper artwork. Sometimes the missing piece is the schematic, the BOM, or the firmware — or all three. Partial-scope engagements cost less and solve the actual bottleneck. If you already have some files, you may not need a full board teardown.

Case Study 4: 10-Layer Telecom Backplane — High Pin-Count BGAs and Blind Vias

Situation

A telecom equipment operator in Southeast Asia needed to replicate a 10-layer backplane from a decommissioned switching chassis. The board connected eight daughter cards through high-speed differential pairs and carried three large BGAs (1156-pin, 1.0 mm pitch). No documentation of any kind existed.

Constraints

• Board dimensions: 420 × 310 mm, 2.4 mm stackup
• Blind vias (layers 1–2 and 9–10) plus buried vias (layers 4–7)
• Minimum trace/space: 4/4 mil on inner signal layers
• Controlled impedance: 100 Ω differential, 50 Ω single-ended
• Gold-finger edge connectors on all eight card slots
• Only one sample board available (operational, could not be destroyed)

What We Did

Non-destructive recovery was mandatory. We used industrial CT scanning to map all 10 layers and the via structures without delaminating the board. CT data was supplemented by X-ray imaging of each BGA footprint. Trace extraction was performed layer-by-layer in specialized software, then manually verified against the CT cross-sections.

Impedance modeling required us to identify the laminate (Isola FR408HR, confirmed by TGA analysis of a small edge coupon the client authorized us to remove). Blind and buried via drill files were generated separately, with aspect ratios verified against IPC-2221B limits for the target fab house.

The three BGAs were high-speed SerDes interfaces. We captured their pinouts from the netlist and cross-referenced public datasheets. No firmware extraction was needed — the backplane carried no active programmable ICs.

Result

Turnaround: 18 working days. Deliverables included Gerber files, drill files (three separate drill sets for through, blind, and buried vias), ODB++ package, IPC-2581 stackup definition, BOM (148 line items), and a full schematic. The client’s fab house produced two prototypes; both passed continuity and impedance testing. A production order of 30 units followed.

Lesson

When only one board exists and it cannot be destroyed, CT scanning is the only viable path — but it adds cost (typically $1,500–$4,000 depending on board size) and 3–5 days. Plan for it. Blind and buried vias double the complexity of drill file generation; always confirm via structures before quoting.

Case Study 5: 8-Layer Automotive Sensor Module — Rigid-Flex with Conformal Coating

Situation

An aftermarket automotive parts supplier needed to reproduce a rigid-flex sensor module from a European vehicle platform. The board combined a rigid 8-layer section (52 × 38 mm) with a 2-layer flex tail (120 mm long) that connected to a wiring harness. The entire assembly was conformally coated with a silicone-based compound.

Constraints

• Conformal coating required chemical removal before any layer could be imaged
• Flex tail used polyimide substrate — different CTE, different trace adhesion rules
• Rigid section: 8 layers, 0.8 mm total thickness, HDI with microvias (laser-drilled, 0.1 mm diameter)
• Automotive-grade components (AEC-Q100/Q200 rated) — many with restricted distribution
• MCU: Renesas RH850 with hardware security module (HSM) — firmware encrypted

What We Did

Conformal coating was removed using a targeted solvent soak (xylene-based, 40 minutes at 45 °C) without damaging the flex polyimide. The rigid section was cross-sectioned at three points to confirm the HDI stackup: two sequential lamination cycles, microvias connecting layers 1–2 and 7–8, buried vias on layers 3–6.

The Renesas RH850’s HSM encryption made firmware readout infeasible with current methods. We informed the client upfront that the MCU contents could not be recovered — this is a realistic limitation, not every chip can be read. The client had a working board and was able to source pre-programmed RH850 units from their original firmware developer under a separate agreement. Our scope covered hardware only: Gerber files, rigid-flex fabrication notes (bend radius, stiffener placement, coverlay specifications), and BOM.

To understand why some chips resist recovery, review our overview of how chip security mechanisms actually function. We always provide a feasibility assessment before quoting firmware work.

Result

Turnaround: 14 working days for the hardware file set. The client fabricated 10 prototype assemblies at a flex-rigid specialist fab. Eight of ten passed environmental testing (thermal cycling −40 °C to +125 °C, 500 cycles). The two failures were traced to a coverlay adhesion issue at the rigid-flex transition — a fab process problem, not a file error. After fab parameter adjustment, the next 10 units passed at 100%.

Lesson

Rigid-flex boards require fabrication notes that go far beyond standard Gerber outputs: bend radius minimums, stiffener drawings, coverlay cutout dimensions, and polyimide material callouts. Without these, even perfect copper data will produce unreliable boards. Also, not every MCU can be unlocked — honest feasibility assessment before engagement saves everyone time and money.

What These PCB Reverse Engineering Case Studies Have in Common

Across all five projects, several patterns repeat:

If you are evaluating whether your board fits the profile for recovery, the eight most common scenarios requiring reverse engineering provide a good starting checklist.

Deliverable Formats Across All Cases

For a broader look at completed projects, browse our recovered board portfolio.

Avoiding Common Pitfalls

These case studies also illustrate what goes wrong when corners are cut. Damaged traces from aggressive desoldering, incorrect stackup assumptions on multilayer boards, and failure to verify impedance models against physical cross-sections are the three most frequent errors we see from less experienced providers. Our detailed breakdown of common PCB copy mistakes covers the full list.

Related reading

• Oct 2026NXP LPC18 Unlock | Feasibility, Cost & Lead Time
• Oct 2026Analog Devices IC Unlock | Families We Can Read
• Oct 2026NXP LPC17 Crack | Protection Levels & Recovery