If he can't do something like "strings /System/Library/PrivateFrameworks/MediaAnalysis.framework/Versions/A/mediaanalysisd" I don't think any actual investigation of the binary or traffic is the first step of learning for him to take...