My suggestion hinges on the assumption that if the backup has a passcode, then maybe that is the same passcode used on the phone.
So the solution is to crack the backup passcode. There is no increasing delay when trying to restore an iPhone from a backup. Just the amount of time it takes you to click the buttons and enter a password when prompted by iTunes. You are entering the password on the computer, not the phone (besides I suggest to use a different phone because you don't want accidentally overwrite what is on his dad's phone).
Run the script, let it take however many hours it takes to try 10,000 possible passcodes. If one works THEN you try that same passcode on the phone itself. With any luck they are the same. If they aren't well you haven't lost much but the time waiting for the script to end.