Professional PCB Reverse Engineering Services
PCB reverse engineering services recover complete manufacturing data — schematics, Gerber files, bills of materials, and firmware — from a physical circuit board when original design files are lost, unavailable, or never existed. Our engineers work from a single sample board, delivering production-ready output files typically within 5 to 20 working days depending on layer count and complexity. The service supports boards from 1-layer single-sided designs up to 32-layer HDI stackups, covering rigid, flex, and rigid-flex constructions.
If you’re new to the concept, our plain-English guide to PCB reverse engineering covers the fundamentals before you commit to a project.
What Do PCB Reverse Engineering Services Actually Deliver?
The output isn’t a vague “analysis report.” You receive a defined set of manufacturing-ready files. Here’s exactly what each deliverable includes and its typical format:
| Deliverable | Format(s) | What It Contains |
|---|---|---|
| Schematic | PDF, Altium (.SchDoc), OrCAD (.dsn), KiCad (.kicad_sch) | Complete netlist with component values, reference designators, and net names; multi-sheet for complex boards |
| Gerber Files | RS-274X, Gerber X2, ODB++ | Every copper layer, solder mask, silkscreen, paste layers, drill files (Excellon), board outline (DXF/DWG) |
| BOM | Excel (.xlsx), CSV | Part number, value, package, manufacturer, distributor cross-references, substitution notes for obsolete parts |
| Netlist | IPC-D-356A, Protel, generic ASCII | Net connectivity verified against schematic for DRC/ERC pass |
| Firmware Image | .bin, .hex, .srec | Raw flash dump from MCU/FPGA (when authorized and technically feasible) |
| Stackup Report | Cross-section micrograph data, dielectric thicknesses, copper weights, impedance calculations |
For projects that need only the PCB layout data, our PCB-to-Gerber extraction service provides Gerber and drill files without full schematic capture — faster turnaround, lower cost.
How the Process Works — Step by Step
1. Board Intake and Feasibility Assessment
You ship one or two sample boards. We photograph both sides at high resolution, X-ray the board to confirm layer count, and run an initial component inventory. Within 2 business days you receive a feasibility report with a firm quote, layer count confirmation, and an estimated timeline. Boards with BGA-only ICs, potted modules, or conformal coating add 1–3 days to this assessment.
2. Delamination and Layer Imaging
For multi-layer boards, we use controlled chemical etching and precision mechanical milling to expose each internal copper layer. Each layer is scanned at 1200 DPI minimum (2400 DPI for trace/space below 4 mil / 0.1 mm). Fiducial alignment marks and tooling holes are used to register layers to within ±0.5 mil. This step is destructive — that’s why we request a second sample for verification whenever possible.
3. CAD Reconstruction
Layer images are vectorized and imported into Altium Designer or equivalent EDA software. Our engineers manually trace every net, verify pad-to-via connections, and assign net names. Typical accuracy: ≥99.5% net correctness on boards up to 8 layers, ≥98.5% on 12+ layer HDI boards before verification.
4. Component Identification and BOM Generation
Every component is identified by package, marking code, and electrical measurement. We cross-reference against distributor databases (Digi-Key, Mouser, LCSC) and flag any end-of-life parts with recommended substitutes. Passive values are confirmed with LCR meter readings when markings are ambiguous or missing.
5. Schematic Extraction
The netlist from the PCB layout drives schematic creation. We organize sheets by functional block — power supply, digital core, analog front-end, I/O connectors — so the schematic is readable and maintainable, not just electrically correct.
6. Verification and DRC/ERC
Every project passes a full Design Rule Check and Electrical Rule Check. We compare the reconstructed netlist against a continuity test of the original board. Discrepancies are resolved before delivery. You receive a verification report documenting any anomalies found and how they were resolved.
7. Delivery and Support
Files are delivered via encrypted transfer. We provide 30 days of post-delivery support for questions, format conversions, or minor corrections.
Layer Count and Complexity: What Changes
Layer count is the single biggest driver of cost and turnaround. Here’s a realistic breakdown:
| Layer Count | Typical Turnaround | Starting Price Range (USD) | Key Challenges |
|---|---|---|---|
| 1 layer | 3–5 days | $200–$500 | Minimal; jumper wires may be missed |
| 2 layers | 5–7 days | $400–$1,200 | Through-hole vias straightforward |
| 4 layers | 7–10 days | $800–$2,500 | Internal plane identification; blind vias possible |
| 8 layers | 10–15 days | $2,000–$5,000 | Impedance-controlled pairs; buried vias |
| 16 layers | 15–20 days | $5,000–$12,000 | HDI microvias; sequential lamination; dense BGA breakout |
| 20–32 layers | 20–30 days | $10,000+ | Multiple via types; tight registration tolerances; may require multiple samples |
Prices vary with board size (we measure in square inches of PCB area), component density, and whether firmware extraction is included. These ranges reflect boards under 100 cm² with moderate component counts.
When Firmware Recovery Is Part of the Scope
Many boards contain programmed microcontrollers, FPGAs, CPLDs, or serial flash that must be read out for a functional clone or repair. Our firmware and hardware bundle service handles both PCB layout recovery and firmware extraction as a single project.
Firmware readout is technically feasible on many devices — but not all. Fuse-locked MCUs (e.g., certain STM32 RDP Level 2, Microchip CRP configurations) may be permanently unreadable. We assess feasibility before you pay. Authorization is required: you must demonstrate ownership or legal right to the IP. Every firmware project is covered by NDA.
What “Authorized Recovery” Means in Practice
- You designed the board and lost the source — straightforward recovery of your own IP.
- You purchased the product and need to maintain or repair it — legacy support, spare-part manufacturing.
- You hold a license or written authorization from the IP owner.
We do not extract firmware for the purpose of pirating or counterfeiting third-party designs.
Industry-Specific PCB Reverse Engineering Services
Different sectors bring different constraints. A medical device board demands IPC Class 3 accuracy and documentation that supports regulatory resubmission. A military legacy board may use obsolete MIL-spec components that need modern cross-references. An HVAC controller might be a simple 2-layer board, but the OEM went out of business ten years ago and no replacement exists.
- Medical devices — Our medical device PCB guide details how we handle IEC 60601 considerations and traceability requirements.
- Military and defense — Obsolescence recovery for boards with ITAR-controlled or discontinued components; see our military PCB reverse engineering guide.
- Industrial controls — Inverter drives, HVAC controllers, test instruments — boards where downtime costs thousands per hour.
- Consumer and IoT — High-volume clone support, second-source qualification, and cost-reduction redesign.
What Can Go Wrong — Honest Limitations
No responsible provider claims 100% success on every board. Here are real failure modes and how we mitigate them:
- Layer delamination damage. On very old boards (15+ years, especially with high-Tg FR-4 or polyimide flex), delamination can destroy inner-layer traces. Mitigation: we X-ray before delamination and use the second sample for cross-verification.
- Unmarked or custom ASICs. If a board contains a custom IC with no datasheet, we can map its pinout and behavior but cannot replicate the silicon. We document what we find so you can design around it or source a functional equivalent.
- Impedance reconstruction limits. We measure cross-sections to ±0.2 mil dielectric accuracy, but original impedance targets are inferred from trace geometry and stackup — not measured from the original design intent. For RF or high-speed differential pairs, we recommend a prototype verification spin.
- Encrypted firmware. Some MCUs with hardware encryption cannot be read out regardless of technique. We state this upfront in the feasibility assessment.
Equipment and Tools We Use
Our lab runs equipment matched to the precision required for modern PCB reverse engineering services:
| Equipment | Purpose | Specification |
|---|---|---|
| X-ray inspection system | Layer count confirmation, BGA void analysis | 5 µm feature resolution; 160 kV tube |
| High-resolution optical scanner | Layer imaging | 2400 DPI optical; stitched large-format boards up to 24 × 18 in |
| CNC micro-mill | Controlled layer removal | ±0.5 mil depth accuracy |
| LCR meter / curve tracer | Passive component verification | 0.1% basic accuracy; 100 Hz – 100 kHz test frequency |
| Universal programmer | Firmware readout | Supports 100,000+ device types; ISP, JTAG, SWD, SPI interfaces |
| Altium Designer / KiCad | CAD reconstruction | Current release; DXF/DWG import; IPC-2581 export |
Who Uses PCB Reverse Engineering Services?
Our clients fall into several clear categories, each with a different primary need:
- OEMs recovering lost design data — Original designer left, files corrupted, EDA tool version incompatible. They need production-ready output fast.
- Maintenance and repair organizations — Equipment still in service, but the PCB is no longer manufactured. They need a clone or a repair reference.
- Hardware startups — Benchmarking a competitor’s published product (legal under fair-use reverse engineering in most jurisdictions) to inform their own original design.
- Contract manufacturers — Customer supplies a board but no files. CM needs Gerber and BOM to quote and produce.
- Defense and government contractors — DMSMS (Diminishing Manufacturing Sources and Material Shortages) programs that require form-fit-function replacements for obsolete boards.
How to Get Started
The fastest path is straightforward:
- Send us clear photos of both sides of the board (or ship the board directly).
- Specify what you need: Gerber only, full schematic + BOM, firmware extraction, or the complete package.
- We return a feasibility assessment and firm quote within 2 business days.
- Upon approval, work begins immediately. You receive progress updates at each milestone.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewHow much do PCB reverse engineering services cost?
Cost depends primarily on layer count, board area, and component density. A simple 2-layer board under 50 cm² typically starts at $400–$1,200. Complex 8-layer boards range from $2,000–$5,000. Boards above 12 layers or with HDI features start at $5,000 and can exceed $12,000. Firmware extraction, if needed, adds $300–$2,000 depending on the MCU protection level. We provide a firm quote after a free feasibility assessment — no surprises.
How long does PCB reverse engineering take?
Turnaround ranges from 3 working days for a 1-layer board to 20–30 days for boards above 16 layers. The median project (4-layer, moderate density) completes in 7–10 working days. Rush service is available for critical-path projects — typically 40–60% faster at a surcharge. The feasibility assessment, delivered within 2 days of receiving your board, includes a specific timeline commitment.
Is PCB reverse engineering legal?
Yes, in most jurisdictions. Reverse engineering a product you own — for repair, interoperability, maintenance, or to recover your own lost design data — is broadly permitted under U.S. (DMCA §1201 exemptions, trade secret law), EU, and many other legal frameworks. It is not legal to use reverse engineering to manufacture counterfeit goods or infringe active patents. We require proof of ownership or authorization for every project and operate under NDA.
Can you reverse engineer a board with BGA components?
Yes. BGA packages are common on boards we process. We use X-ray inspection to map BGA ball patterns and via fan-out before delamination. The BGA footprint, pin assignment, and breakout routing are captured in the Gerber and schematic output. Boards with multiple large BGAs (e.g., FPGA + DDR memory) add complexity and time but are within our standard capability for boards up to 32 layers.
What if some components on my board are obsolete?
We flag every end-of-life or NRND (Not Recommended for New Design) component in the BOM and provide recommended substitutes with matching footprint, electrical specs, and availability. For critical components with no drop-in replacement, we document the differences and suggest minimal layout modifications. This is especially common in military and industrial legacy boards where components may have been out of production for a decade or more.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote