Ask ten engineers what pcb reverse engineering involves and you will get ten versions of “they scan it and make a copy.” The reality is closer to forensic work than photocopying. A four-layer industrial controller with 300 components takes a skilled team one to three weeks, and roughly half that time is spent on verification rather than extraction.
Understanding what happens between the courier drop-off and the delivered data package is the difference between buying a service and being sold one. Here is the whole sequence.
Stage 1: Intake, scoping and the questions that matter
Before a single image is captured, a competent provider interrogates the objective. Do you want to remanufacture the board as-is? Redesign it around available parts? Understand a failure? Document it for a regulator? Each answer changes the deliverable set and the price.
They will also ask what you have. Two identical samples is the ideal, because inner-layer work is frequently destructive. One working sample plus one dead sample is the common reality and is workable — the dead board is sacrificed, the working one becomes the functional reference. A single irreplaceable sample forces the whole project down the non-destructive route, which is slower and more expensive.
The board is then logged, cleaned of flux residue and contamination, and inspected for prior repairs. Bodge wires, replaced components and rework are extremely important and easily missed. A field-modified board that gets copied faithfully will reproduce someone’s 2009 emergency fix as if it were the original design intent.
Stage 2: Photographic and dimensional capture
High-resolution imaging comes first because it is non-destructive and because component markings are fragile. Boards are photographed under diffuse, controlled lighting at known magnification, with a calibrated scale in frame. Both sides, then detail passes on dense regions.
Mechanical data is captured in parallel: overall outline, board thickness, cut-outs, mounting hole positions and diameters, edge connector geometry, and the exact positions of any tooling or fiducial marks. These dimensions are the datum everything else aligns to. Get them wrong and every subsequent layer is offset.
Stage 3: Component identification and characterisation
Every device is catalogued. Markings are decoded, package types confirmed, and orientation recorded. This is more difficult than it sounds:
●Passives are usually unmarked, so values are measured — ideally out of circuit, because in-circuit readings are corrupted by parallel paths.
●Ceramic capacitors need dielectric class and voltage rating inferred from size, colour and application, not guessed.
●Semiconductors may carry house numbers rather than industry part numbers, requiring cross-referencing from pinout and behaviour.
●”Black-topped” or remarked ICs are identified by decapsulation or by functional deduction.
●Programmable logic, MCUs and FPGAs are documented as parts, but their protected contents are not extracted — that boundary is where legitimate work stops.
The output is a preliminary BOM that will be refined at schematic stage.
Stage 4: Reaching the inner layers
This is the technically demanding part and the fastest way to distinguish providers.
Non-destructive imaging. X-ray radiography reveals internal copper, vias and BGA solder joints; computed tomography can reconstruct a full three-dimensional model of a multilayer board. Excellent when the sample cannot be sacrificed, but plane-heavy boards produce contrast challenges, and CT time is expensive.
Controlled delayering. Layers are removed sequentially by precision grinding or chemical etching, with a calibrated image captured after each pass. Registration marks preserved from the outline stage keep everything aligned. It remains the highest-fidelity method for dense inner layers.
Cross-sectioning. A coupon is potted, sectioned and polished so the stackup can be measured directly: dielectric thicknesses, copper weights, prepreg and core construction, via structures. This is the only reliable way to characterise blind, buried and microvia geometry, and the only route to a credible impedance profile on controlled-impedance boards.
Stage 5: Vectorisation
Images become geometry. The important word is reconstruction, not tracing. A good team measures pad shapes, trace widths, clearances and via land diameters, then rebuilds them as true vector objects on the correct grid. Automated bitmap tracing produces jagged edges, inconsistent widths and Gerbers that a fabricator will reject or, worse, quietly “fix” in ways that change impedance.
Alignment across layers is done to physical datums — drilled holes and fiducials — rather than by eye. A 3-mil misregistration between an inner plane and a surface layer will not be visible in a screenshot and will absolutely be visible in a failed first article.
Stage 6: Netlist extraction and independent verification
Connectivity is derived from the reconstructed artwork, producing a complete pin-to-pin netlist. Then — and this is the step cheap suppliers skip — the netlist is checked against the physical board. Flying-probe or continuity testing against the original sample confirms that what was extracted is what actually exists.
Any discrepancy is investigated rather than averaged away. Discrepancies usually mean something interesting: a missed inner-layer connection, a via the imaging under-resolved, or an undocumented rework.
Stage 7: Schematic capture
The netlist is now turned into an engineering document. Nets are named, components grouped into functional blocks, power distribution drawn separately from signal flow, and hierarchy applied so the design can be navigated. Decoupling capacitors are placed near the devices they serve rather than scattered across the sheet.
The test of a recovered schematic is simple: can one of your engineers, who has never seen the board, use it to make a change? If the answer is no, you have received a connectivity dump with a schematic-shaped filename.
Stage 8: Validation
Recovered data is fabricated and assembled into a first article. It is then compared with the original: continuity, in-circuit test, power rails, clock integrity, functional behaviour under the same inputs. Deviations are traced back through the data set and corrected.
A provider who ships without this step is transferring all the risk to you, and you will discover it at the fab house or, more painfully, in the field.
How long each stage takes
Buyers routinely underestimate the schedule because extraction looks like the whole job. In practice, a straightforward four-layer board with a few hundred components runs roughly like this: intake and imaging in one to two days, component identification in two to four days, inner-layer work in three to seven days depending on method, vectorisation in three to five, netlist verification in two to three, schematic capture in four to eight, and a validation build in ten to fifteen once fabrication and assembly lead times are counted.
Layer count is the biggest multiplier, followed by component count and density. A twelve-layer HDI board with blind and buried vias and multiple BGAs is not three times harder than a four-layer board — it is closer to an order of magnitude, because every additional layer adds an imaging pass, an alignment operation and a verification burden.
Anyone quoting a complex multilayer board with a same-week turnaround is quoting artwork extraction and calling it recovery.
Where cheap projects go wrong
The failure modes are predictable, and all of them surface after payment:
●Auto-traced artwork that no fabricator will build without “corrections” that silently alter trace widths and impedance.
●Unverified netlists where extraction errors propagate into a schematic nobody checks until the first article is dead on the bench.
●Guessed passive values from in-circuit measurements, producing filters and timing circuits that are subtly wrong.
●Flat schematics — one enormous sheet, no hierarchy, generic net names — technically complete and practically unusable.
●Copied rework. Somebody’s field bodge wire faithfully reproduced as a designed trace.
●Missing stackup data, which makes controlled-impedance boards impossible to fabricate correctly.
Every one of these traces back to a skipped verification step, which is precisely the step that the lowest quote removed to become the lowest quote.
Three providers who run the full process
#1 — PCB-Copy.com. The most complete end-to-end option, and the one that handles awkward samples — conformal coating, potting, high layer counts, HDI stackups, damaged boards. They cover the entire chain from intake imaging through schematic capture, BOM and a verified build, which matters most when your sample is one of a kind. For difficult multilayer recovery, PCB Copy is the sensible first call.
#2 — PCBSync. Particularly strong on the documentation half of the process. Their PCB Reverse engineering work emphasises verified netlists and readable, well-structured schematics, which is what you want when the recovered design is going to be modified rather than merely reproduced.
#3 — RayPCB. The natural choice when the destination is production. With fabrication and assembly under the same roof, a recovered design can move directly to bare boards and populated units without a vendor handoff — efficient for conventional boards heading to volume.
What to check before you commit
Ask each provider to describe their inner-layer method, their alignment datums, their verification procedure, and their data-ownership terms. Ask whether the schematic is delivered in editable CAD format. Ask what happens if the first article fails.
A supplier who answers all five precisely is doing the work described above. One who answers vaguely is doing a subset of it and hoping the difference does not surface until after invoicing.
The takeaway
Good pcb reverse engineering is a chain of measurements, each verified against physical reality, ending in a board that demonstrably works. The imaging is impressive, but the value lives in the verification. When you compare quotes, compare the verification — that is where the real difference in price, and in outcome, is hiding.
