Itunes Backup

[rk]

Then that .plist file doesn't contain the RestrictionsPassword key.

The restrictions backup key is useful for deriving the user's pin, but that will not allow access to an iTunes encrypted backup.  

The encrypted password is located in the manifest.plist file of an iTunes encrypted backup.  Cellebrite, Elcomsoft, and the other iTunes backup cracking tools need only the manifest.plist file to run an attack on the pw.  The 'keybag' part of this file contains several attributes that would need to be decoded to find the hash, salt, and sha1 iteration count.