Extract Camera Roll from iTunes backup
There are third-party applications such as iBackupViewer and iPhone Backup Extractor that will read those backup files. 

Also, if by any chance Photostream was turned on, those photos are on somebody's Mac, hiding in

~/Library/Application Support/iLifeAssetManagement/assets/sub