Can you recover a password stored in Apple Remote Desktop?

I have a server that's not been touched in a while and the password has been long forgotten. However, we were able to login with ARD up until it was restarted (now FileVault is in the way). So, I know the password is still in ARD, but I've yet to find any place to view the password. We have the ARD password to decrypt and encrypted passwords, but we just don't know where to look for the password.

What I've checked so far:

Keychain Access - This appears to only store the ARD password. I presume this password encrypts the connection details separately (and I recall the password that's shown here is the one I used to setup ARD in the first place).

The documentation for ARD (for V2 anyway) suggests data is stored in three places, user library plist, /Library plist, and /var/db/RemoteManagement/: https://images.apple.com/remotedesktop/pdf/ARD_Admin_Guide.pdf

• Place 1: The data in /var/ seems to be an sqlite3 database with usage statistics. Nothing of importance.
• Place 2: The /Library/ plist seems to be nothing eye catching. Just a single reference to the user desktop.
• Place 3: ~/Library/ plist (in containers nowadays) has all the client details (username, IP address, hostname, etc.) but I don't see anything resembling a password (encrypted or not).

I used to use fseventer to find recently modified files (start fseventer, preform action in app, see all files modified) but that's been abandoned long ago. Any hints as to where to find ARD's passwords?