This chain might be totally dead by now, but I needed my own answer today to recover once again once my old phone died.  Partially with the thought that I might need this again one day, I'm putting in more details.  It would be a bonus if someone else was able to recover their BTC based on these instructions.

Here's more information.  I did the following on my Mac:

cd /Users/Darryl/Library/Application Support/MobileSync/Backup/b24f78d91322ec7b4f32a60884b63d097ef8613f-20130920-232753
(Your exact backup location is probably different)

for file in *; do echo "==== $file ===="; strings $file; done > ~/a
(What this does is run the 'strings' command on each file, and put a header of the filename inside ====.)

Then I did:
less ~/a
(This is a command-line viewer of the data)

Then I found the content below (marked with ***) ... you can type the / key, then paste in some of the text here, perhaps WebKitLocalStorageDatabasePathPreferenceKeyYsharedKey will do it.  That jumped to the following text.  Possibly the backup filename is always  6efc668a42109f1e4e1da7ab631d8720761a175a... who knows.  This is what worked for me.  If you know your wallet identifier from https://blockchain.info/wallet/<WALLET ID>, you should search for the wallet id.  The line after I found my Wallet ID, I saw my password in plaintext.  I used it today on the website to once again decrypt my password.  I'm upgrading it now and will try out the backup features.


This is "the content below (marked with ***):

==== 6efc668a42109f1e4e1da7ab631d8720761a175a ====
bplist00
+WebKitLocalStorageDatabasePathPreferenceKeyYsharedKey_
'WebKitOfflineWebApplicationCacheEnabledTguid_
ATDatabaseLastUpdateXpassword_
'WebKitDiskImageCacheSavedCacheDirectory_
WebDatabaseDirectoryZregistered^checksum_cache_
"WebKitShrinksStandaloneImagesToFit_
L/var/mobile/Applications/F131A0E7-72C2-4B03-A039-EFFD0BD6A56B/Library/Caches_
$52153CED-87D1-4A4D-A58C-F9499F3DA6BE

Followed immediately by $<WALLET ID> and on the next line /<MY UNENCRYPTED PASSWORD>

I had the same problem and found this forum post that gave me a hint to check the application data files.  I was able to recover my plaintext password from an old iPhone backup file (From September 2013).  I did not have to jailbreak the phone.  I used the 'strings' command on my Mac on all of the files in the backup directory and sifted through the results until I found what I was looking for.  I mention it here in case someone else stumbles upon this page and would like assistance getting to their BTC.  I expect the latest blockchain app doesn't save the password in plaintext anymore, so perhaps this technique will work for others as well.

In the future, I'll be using one of these to hold my BTC: http://bitstash.com/