You can find the schematic for the NanoVNA V2 on github: https://github.com/nanovna-v2/NanoVNA2
How does the VNA measure S11 return loss?
With an RF Bridge and a balun, brilliant.
You can try it for yourself in spice as follows:
When the DUT test impedance is equal to the 50 Ohms, the bridge is balanced and there is no differential output signal. The balun attempts to reject the common mode signal.
Kudus to the designer, clean, simple, cheap... love it.
Contrary to a high-end VNA, where there may be separate directional couplers to measure simultaneously the forward incident power and the reflected power:
The NanoVNA2 periodically switches the measurement port to an open (which in turn causes all the forward power to be reflected and measured in the bridge)
More commodity engineering, great work!
How about something more "complex", like say a capacitor with a reactance of -50j Ohms. We can use a smith chart to find the load reflection coefficient gamma
Every value on the Re(z) = 0 (lossless components) has a gamma with a magnitude of 1 (ie all incident power is reflected because the component is lossless).
gamma(Z=-50j) = -j = 1 <-90'
The addition of a transmission line of characteristic impedance zo rotates the apparent gamma clockwise, with 1/4 lambda rotating the apparent impedance 180'.
So in spice I am testing at 1MHz, so a capacitor with an impedance of -50j is a 3.183 nF capacitor.
With no tx-line we see gamma=-j, at 1/8 lamda a short circuit, and at 1/4 lambda an inductor with a value of +50j ohms.
Same graph again as magnitude and phase, note constant amplitude varying phase
neat circuit.
Yay! That is exciting, these low cost VNA are nothing to fear 
I have the SAA2 which is a step forward from the orginal nanovna. There are a few others too, but I haven't tried them. I also bought the Rf Demo kit board
I will post some sample measurements soon. It has some quirks and those painful u.FL connectors... tradeoffs.
