bloodfart, 4 days ago

Just turn off the vm (shutdown the windows install running in the vm, not pause), mount the vm block device, navigate to the file and get it that way.

Are you using qemu?