Not for urlsessions with pinned keys, especially not on AMFI binaries you can't patch if you're not in development mode.
well, sounds like he has his work cut out for him then.
If he can't do something like "strings /System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd" I don't think any actual investigation of the binary or traffic is the first step of learning for him to take...