What a PCB Reverse Engineering Case Study Actually Shows
A PCB reverse engineering case study documents the full arc of recovering manufacturable files from an existing circuit board — starting from the physical sample, through imaging and delayering, to verified Gerber output, schematic, and BOM. Unlike marketing testimonials, a useful case study states the board’s layer count, condition, IC complexity, what went wrong, and how long recovery took. The six cases below are drawn from real projects with identifying details anonymized under NDA.
Each case follows the same structure: the client’s situation, the board’s physical specs, the constraints our engineers faced, the methods applied, and the final deliverables. If you’re evaluating whether your own board is a candidate, these examples give you realistic benchmarks for timeline, cost drivers, and success factors.
Case 1 — Corroded 2-Layer Industrial Motor Controller
Situation
A European packaging-line OEM needed to replicate a 2-layer through-hole motor controller from 1998. The original manufacturer had closed, no documentation survived, and the only available sample had visible green corrosion across 30% of the copper on the bottom layer. The board measured 160 × 100 mm, FR-4, 1.6 mm thickness, with 42 through-hole components and three relay footprints.
Constraints
Corrosion had eaten through two traces near the power input header, making continuity testing unreliable in that region. Three electrolytic capacitors had leaked, obscuring silkscreen markings underneath. The single sample meant destructive delayering was off the table.
Method & Outcome
High-resolution optical scanning at 2400 DPI captured both layers. Our engineers reconstructed the two broken traces by cross-referencing the schematic netlist against the relay driver IC datasheet (an SN754410). Component values were confirmed with LCR meter readings. Gerber files, schematic (OrCAD format), and a 42-line BOM were delivered in 5 working days. A prototype run of 10 boards passed functional test on the client’s motor test rig with zero ECOs.
Case 2 — 4-Layer Telecom Power Supply With Obsolete Regulator
Situation
A Middle Eastern telecom operator ran a legacy base-station power supply that used a discontinued LM2596-based regulation circuit on a 4-layer board (dimensions: 120 × 85 mm, 1.0 mm, 2 oz copper on inner layers). They needed 200 replacement units and had two working samples.
Constraints
Inner-layer imaging required controlled chemical delayering of one sample. The LM2596HVS variant used was no longer in production, so a pin-compatible substitute (TI LM2596S-ADJ, still active) had to be validated against the original feedback network. Impedance-controlled traces on Layer 2 carried a 5 V / 3 A rail at 300 kHz switching — tolerance mismatch risked increased ripple.
Method & Outcome
One board was delayered; the second kept as a functional reference. X-ray imaging confirmed via placement and BGA-free construction. Inner-layer artwork was captured after each etch step using a calibrated 20 MP camera rig. Trace widths on the power plane measured 40 mil (1.02 mm) ±1 mil. The substitute regulator was validated on a bench prototype before BOM finalization. Deliverables: Gerber RS-274X, Altium .SchDoc, 58-line BOM with alternates column. Turnaround: 8 working days. The 200-unit production run passed IPC-A-610 Class 2 inspection.
Case 3 — 6-Layer Automotive Sensor Interface
Situation
A North American Tier-2 automotive supplier needed to reverse-engineer a 6-layer sensor-interface board from a discontinued European vehicle platform. The board (88 × 54 mm, 1.2 mm, immersion gold finish) interfaced a MEMS accelerometer and CAN transceiver to the vehicle bus. Three samples were provided, one populated, two bare.
Constraints
The board used blind vias (L1–L2 and L5–L6) and 6/6 mil trace/space on signal layers. The CAN transceiver (NXP TJA1050) was straightforward, but the MEMS sensor (Bosch BMA280) had undocumented pull-up resistor values on the SPI bus that weren’t in the public datasheet. Two decoupling capacitor values were unlabeled 0201 packages.
Method & Outcome
Cross-sectional microsection confirmed the stackup: signal / ground / signal / power / signal / signal with 4-mil prepreg between L1–L2. Blind vias were mapped via X-ray before delayering. The unlabeled 0201 caps were measured in-circuit at 100 nF and 10 nF (confirmed post-removal on an impedance analyzer). SPI pull-up values were derived by measuring the bus voltage divider with the sensor powered — 4.7 kΩ matched expected Bosch application-note guidance. Deliverables: Gerber, ODB++, schematic, 67-line BOM. Turnaround: 12 working days. First-article boards passed CAN communication testing at 500 kbit/s.
Case 4 — 8-Layer Industrial PLC Backplane
Situation
A Southeast Asian factory automation integrator maintained 40+ machines running a proprietary PLC whose backplane board (310 × 220 mm, 8 layers, 2.0 mm, HASL finish) had become unobtainable. Mean time between failure was roughly 6 years, and the installed base was approaching that age. One working and one failed sample were available.
Constraints
The board carried a 96-pin DIN 41612 connector array with tight 8/8 mil routing on inner layers. Two inner ground planes had irregular split-plane geometry to separate analog and digital grounds. The failed board had a burned-through trace on Layer 4 (power distribution), which complicated continuity verification. Total component count: 186 passives, 22 ICs, 6 connectors.
Method & Outcome
The failed board was sacrificed for delayering; the working board was used for electrical verification. Each of the 8 layers was photographed after chemical stripping under controlled lighting. The burned Layer 4 trace was reconstructed by tracing the power net from the working board’s test points using a flying-probe setup. Split-plane boundaries were digitized with ±2 mil accuracy. Deliverables: Gerber, IPC-2581, full schematic, 208-line BOM. Turnaround: 15 working days. Prototype backplane accepted all existing slot cards without modification. For details on how each imaging step works, see our step-by-step PCB copy workflow page.
Case 5 — 10-Layer RF Front-End Module
Situation
A defense-adjacent research lab needed to replicate a 10-layer RF front-end board (62 × 48 mm, Rogers RO4350B / FR-4 hybrid stackup, ENIG finish) used in a spectrum-monitoring receiver. The original design house had been acquired and all IP was inaccessible. One working sample, no bare boards.
Constraints
Mixed-dielectric stackup meant standard delayering chemistry wouldn’t strip Rogers and FR-4 at the same rate. 50 Ω microstrip lines on L1 required trace-width accuracy within ±0.5 mil (0.0127 mm) to maintain return loss below −20 dB at 2.4 GHz. Several 0402 components sat under an RF shield can that had to be removed without disturbing adjacent placements. Two LNA ICs (Qorvo QPL9547) were in QFN-16 packages with exposed ground pads.
Method & Outcome
Shield cans were removed by hot-air reflow at 260 °C with localized shielding of adjacent components. Rogers layers were separated mechanically after thermal cycling; FR-4 layers followed standard chemical etch. Microstrip widths were measured with a calibrated optical comparator — L1 traces came in at 11.8 mil (0.300 mm), consistent with RO4350B Dk 3.66 at 2.4 GHz. Impedance simulation in Polar Si9000 confirmed 50.2 Ω. Deliverables: Gerber, stackup report with dielectric specs, schematic, 91-line BOM. Turnaround: 18 working days. First-article VNA sweep showed S11 ≤ −21 dB across the 2.4–2.5 GHz band. Our guide to reverse-engineering accuracy explains how tolerances like these are validated.
Case 6 — 14-Layer Medical Imaging Processor Board
Situation
A hospital equipment maintenance group in South America needed to clone a 14-layer processor board (195 × 145 mm, 2.4 mm, impedance-controlled, via-in-pad with cap plating) from an ultrasound system whose OEM had exited the market. Two samples provided: one functional, one with a failed FPGA.
Constraints
This was the most complex board in this PCB reverse engineering case study set. Layer count alone drove cost — 14 layers with 4/4 mil trace/space on signal layers and buried vias between L3–L12. The FPGA (Xilinx Spartan-6 LX75, BGA-484) required X-ray imaging to map all ball connections before desoldering. DDR3 memory routing on Layers 5–6 demanded length-matched differential pairs with ±5 mil tolerance. The functional board could not be destroyed.
Method & Outcome
The failed-FPGA board was delayered over 14 sessions — each layer photographed, aligned using fiducial marks, and digitized. X-ray tomography mapped all 484 BGA balls plus 38 buried vias before any chemical work began. DDR3 pair lengths were measured digitally post-capture and matched to within ±3 mil of each other. The functional board was used solely for powered netlist verification via boundary-scan (JTAG) on the FPGA and continuity probing on passive nets. Deliverables: Gerber, ODB++, hierarchical schematic (12 sheets), 312-line BOM, stackup specification document. Turnaround: 25 working days. First-article board booted the ultrasound firmware on initial power-up.
Summary Comparison Table
| Case | Layers | Board Size (mm) | Key Challenge | Components | Turnaround (days) | Deliverables |
|---|---|---|---|---|---|---|
| 1 — Motor Controller | 2 | 160 × 100 | Corrosion, single sample | 42 | 5 | Gerber, schematic, BOM |
| 2 — Telecom PSU | 4 | 120 × 85 | Obsolete regulator | 58 | 8 | Gerber, schematic, BOM |
| 3 — Automotive Sensor | 6 | 88 × 54 | Blind vias, unlabeled 0201s | 67 | 12 | Gerber, ODB++, schematic, BOM |
| 4 — PLC Backplane | 8 | 310 × 220 | Split planes, burned trace | 208 | 15 | Gerber, IPC-2581, schematic, BOM |
| 5 — RF Front-End | 10 | 62 × 48 | Mixed dielectric, 50 Ω lines | 91 | 18 | Gerber, stackup report, schematic, BOM |
| 6 — Medical Processor | 14 | 195 × 145 | BGA-484, DDR3 length matching | 312 | 25 | Gerber, ODB++, schematic (12 sheets), BOM, stackup doc |
What These Cases Teach About Feasibility
Several patterns emerge across all six projects:
- Layer count is the primary cost and time driver. Turnaround roughly doubled from 2-layer to 8-layer, then continued climbing. Our detailed pricing guide explains every cost driver in depth.
- Sample condition matters enormously. Corrosion, burned traces, and leaked capacitors all add recovery steps. Check our board sample condition and quantity checklist before shipping.
- Having two samples is strongly preferred. One can be sacrificed for delayering while the other serves as a functional reference. When only one sample exists (Cases 1 and 5), non-destructive methods are possible but add time and risk.
- Obsolete components aren’t a blocker — they’re a BOM task. Pin-compatible substitutes exist for most discontinued passives and many active ICs. The BOM deliverable includes an alternates column for this reason.
- RF and impedance-controlled boards demand extra validation. Simulation tools (Polar Si9000, VNA sweeps) are non-negotiable for anything above 100 MHz.
If you’re unsure whether your board falls into a recoverable category, the FAQ answers 30 questions buyers commonly ask about complexity limits, turnaround, and what happens when recovery isn’t fully possible.
How to Use These Case Studies to Scope Your Own Project
Match your board’s layer count and component density to the closest case above. That gives you a rough turnaround bracket. Then adjust for these factors:
- Board condition: Heavy corrosion or physical damage can add 2–5 days.
- BGA / fine-pitch ICs: Each BGA requiring X-ray mapping adds roughly 1 day per device.
- Mixed dielectrics (Rogers, polyimide, ceramic): Non-standard materials increase delayering complexity by 30–50%.
- Firmware or FPGA bitstream recovery: If the board contains programmed microcontrollers or FPGAs, firmware readout is a separate scope item with its own feasibility assessment. Authorization and proof of ownership are required — see our policies on the real line between reverse engineering and counterfeiting.
For boards with characteristics similar to Cases 5 or 6, we recommend starting with a feasibility evaluation before committing to a full project. You can reach out to our engineering team with photos and a brief description to get an initial assessment within 48 hours.
How long does a typical PCB reverse engineering project take?
Turnaround depends primarily on layer count and component density. Simple 2-layer boards can be completed in 5–7 working days. Complex multi-layer boards (10+ layers, BGA ICs, impedance-controlled routing) typically require 15–25 working days. Rush service is available for simpler boards but not recommended for high-layer-count projects where accuracy is critical.
Can a board be reverse-engineered from a single sample?
Yes, but with trade-offs. Non-destructive methods (X-ray, high-resolution optical scanning, powered probing) can recover most information without delayering. However, inner-layer detail on boards with 4+ layers is significantly easier to capture when one sample can be sacrificed. We always discuss sample strategy before starting work.
What file formats are delivered at the end of a project?
Standard deliverables include Gerber RS-274X (or Gerber X2), drill files (Excellon), a component BOM in spreadsheet format, and a schematic in PDF plus a native EDA format (Altium, OrCAD, or KiCad by request). For complex boards, we also provide ODB++ or IPC-2581 and a stackup specification document.
What if some components on the board are obsolete?
Obsolete components are flagged in the BOM with current-production alternates where pin-compatible options exist. If no drop-in substitute is available, our engineers document the original part’s specifications so your team can evaluate a redesign of that sub-circuit. This situation arose in Case 2 above and was resolved without layout changes.
Is reverse engineering a PCB legal?
Reverse engineering for interoperability, maintenance, repair, or recovery of your own designs is legal in most jurisdictions. We require proof of ownership or authorization before starting any project and operate under NDA. We do not support counterfeiting or IP theft. Our FAQ and trust documentation cover this in detail.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote