Otherwise, you could probably use PyWallet to dump out the addresses in a wallet.dat file and then run a script that queries a block explorer API to see what the current balance of those addresses is... I'm not aware of any "ready to go"/"off the shelf" scripts that do this at present.
At this point, I tend to believe he's trying to access the funds inside those wallets but is having a hard time cracking it.