I was thinking more of a traffic sniffing. e.g with nothing installed and after the initial activation traffic has passed, icloud disabled, take picture of a gun/whatever they could be interested with, see what happens then, apart from the obvious yahoo weather pulls etc., compare with 10 other phones in the same scenario. But I’m sure the hashes, if they exist, are bundled and sent via encrypted channel and I’m not a hacker or pentester anyway so I don’t really know what I’m talking about.