demuxusb

DeMuxUSB is a C++20 tool suite designed for capturing, demultiplexing, and analyzing USB sessions involving Apple iDevices, focusing particularly on reverse engineering recovery and restore protocols. It enables forensic analysis by allowing users to examine device restores against known baselines to identify deviations or unauthorized modifications, with features such as detailed USB transaction tracking, protocol demultiplexing, and support for various input capture formats like PCAPNG. Noteworthy capabilities also include reconstructing USB device states and extracting TCP streams and plist data, making it a valuable resource for cybersecurity analysis and digital forensics in the Apple ecosystem.