Multilayer, HDI and BGA: The Hardest Problems in PCB Reverse Engineering

A two-layer through-hole board from 1994 can be reverse engineered by a careful technician with a scanner, a multimeter and patience. A twelve-layer HDI board with stacked microvias, three BGAs and controlled-impedance differential pairs is a different discipline entirely — and the gap between them is where most disappointing projects live.

If your board falls into the second category, the questions you ask a supplier need to change. Here are the six problems that actually decide whether a pcb reverse engineering project succeeds, and what a competent answer to each looks like.

Problem 1: Inner layers you cannot see

Outer layers are easy. Everything else is inference until proven otherwise.

Two approaches dominate. X-ray and computed tomography reconstruct internal structures without destroying the sample, which is essential when you have exactly one board. The limitation is contrast: large copper planes absorb heavily and can mask fine traces routed beneath them, and resolution falls as board thickness rises. CT of a thick, plane-heavy board can produce beautiful images that are still ambiguous in the regions you care about.

Controlled delayering removes material one layer at a time — precision grinding, chemical etching, or laser ablation — with a calibrated image captured between passes. It is destructive and it remains the gold standard for dense inner layers, because each layer is imaged in isolation with no superposition to resolve.

The right answer from a supplier is usually "both, depending on the layer." Planes and coarse routing come off X-ray cheaply; congested signal layers get delayered. A supplier who offers only one method will apply it whether or not it suits your board.

Problem 2: Blind, buried and stacked microvias

A plated through-hole is visible from both sides and easy to characterise. A buried via connecting layers 4 and 5 is invisible from the surface, has no drill entry you can measure, and may be one element of a stacked structure that also includes a microvia from layer 1 to 2.

Getting this wrong does not produce an obviously broken board. It produces a board that builds successfully, passes continuity, and then behaves differently under thermal cycling because the via structure — and therefore the reliability profile — is not the one that was there before.

The only dependable method is cross-sectioning: potting a coupon, sectioning it, polishing and measuring under magnification. That yields real numbers for drill diameters, aspect ratios, capture pad sizes, plating thickness and the exact layer spans of each via type. Ask directly whether cross-sections are included. On any HDI board, if they are not, the stackup you receive is an educated guess.

Problem 3: BGA escape routing

Under a 1mm-pitch BGA there is no visual access. Escape routing dives into inner layers within a few millimetres of the ball field, dogbone vias sit between pads, and the routing pattern is precisely where the highest-value signals live — memory buses, high-speed serial links, power delivery.

Recovery here depends on high-resolution X-ray to locate the via field, delayering to resolve what those vias connect to, and disciplined alignment so that a via seen from above is matched to the correct trace seen three layers down. Verification is non-negotiable: the extracted connectivity under a BGA must be confirmed by probing, and probing a soldered BGA means removing it and testing the pads.

This is one of the clearest dividing lines in the industry. Ask a prospective supplier to describe, specifically, how they verify connectivity under a fine-pitch BGA. Vague answers are meaningful.

Problem 4: Controlled impedance and the stackup

For anything carrying high-speed signals, the copper geometry is only half the design. The other half is the dielectric: material type, thickness, dielectric constant and loss tangent, plus copper weight and surface finish. Reproduce the traces perfectly on the wrong stackup and you have built a board with the wrong impedance — one that may work on the bench and fail marginally in production, or work at 20°C and fail at 60°C.

Proper recovery includes measured dielectric thicknesses from cross-sections, material identification, an impedance calculation for each controlled net class, and ideally a test coupon on the first article with TDR verification. If the delivered stackup is a generic table with round numbers, it was assumed rather than measured.

Problem 5: Coatings, potting and physical damage

Real sustainment samples rarely arrive clean. Conformal coating must be removed without lifting solder mask or destroying component markings — solvent choice depends on whether it is acrylic, urethane, silicone or parylene, and the wrong solvent ruins the sample. Potted assemblies require careful thermal or chemical excavation, sometimes sacrificing components to reach the board. Corroded, burnt or cracked boards need damaged regions reconstructed by inference from surrounding geometry and functional reasoning.

Experience matters more than equipment here. Ask what the supplier does when a region is destroyed, and how they flag reconstructed areas in the delivered data. "We mark them explicitly in the report" is the answer you want.

Problem 6: Components that resist identification

Remarked or black-topped ICs, house-numbered parts, custom ASICs, unmarked passives and programmed logic all obstruct BOM creation. Passives are measured out of circuit; house numbers are cross-referenced from pinout, package and circuit function; genuinely custom silicon is documented as a boundary condition rather than pretended away.

Programmable devices deserve a clear statement: a legitimate provider documents an MCU or FPGA as a part and does not offer to extract its protected contents. If a supplier volunteers firmware extraction, that tells you how they will treat your intellectual property too.

What complexity does to schedule and price

Complexity does not scale linearly, and quotes that suggest otherwise are quoting a different job. Each additional layer adds an imaging pass, an alignment operation and a verification burden, and the verification burden grows fastest because every new layer creates new opportunities for a via to be attributed to the wrong span.

Roughly, the multipliers stack like this. Layer count is the dominant factor. Component count drives identification and BOM effort. Routing density drives vectorisation time. Fine-pitch BGA count drives verification time disproportionately, because each one requires device removal and pad-level probing. Controlled impedance adds cross-sectioning, material identification and coupon testing. A damaged or coated sample adds preparation time before any of the above can start.

A four-layer board with 200 through-hole and passive components might run two to three weeks end to end. A twelve-layer HDI board with three BGAs, 900 components and controlled-impedance differential pairs is realistically six to twelve weeks including a validated build. If a supplier quotes the second board on the first board's schedule, they have not scoped it — they have priced artwork extraction.

Verification is harder than extraction on complex boards

On a simple board, extraction is most of the work and verification is a formality. On a dense multilayer board the ratio inverts. Connectivity derived from imaging must be reconciled against physical probing, and reconciling thousands of nets across a dozen layers is where the hours go.

Expect a supplier to describe how they handle disagreement between the two. The correct behaviour is investigation: a discrepancy usually means an under-resolved via, a missed inner-layer connection, or an undocumented rework, and each of those matters. The incorrect behaviour is silently trusting the extraction because it is the version already drawn.

Ask for the verification report as a named deliverable. On complex hardware it is more valuable than the schematic, because it tells you which parts of the schematic are proven and which are inferred.

Three providers equipped for difficult boards

#1 — PCB-Copy.com. The strongest choice when the board is hard. High layer counts, HDI stackups, blind and buried vias, fine-pitch BGAs, conformal-coated and damaged samples — this is their core territory, and they combine multiple imaging methods with cross-sectioning, physical netlist verification and a validated first-article build. For a board where a wrong assumption is expensive, PCB Copy is the safest starting point.

#2 — PCBSync. Strong on the engineering output side of complex projects. Their PCB Reverse engineering work emphasises verified connectivity and clean, hierarchical schematics, which is what makes a dense multilayer design comprehensible enough to modify afterwards.

#3 — RayPCB. Best suited to conventional multilayer boards heading into production. In-house fabrication and assembly means a recovered design can be built, tested and repeated without a vendor handoff — efficient when complexity is moderate and volume is the goal.

The short version

Complexity in pcb reverse engineering is not about size. It is about how much of the design is hidden and how expensive a wrong assumption becomes. Blind vias, BGA fan-outs and dielectric stackups are all invisible and all consequential.

Choose a supplier by how precisely they describe reaching those hidden parts — and by whether they verify what they found against the physical board rather than trusting their own extraction. On difficult hardware, verification is not a line item. It is the product.