Oh wait... could someone confirm it's actually useless to make a raw disk search for encrypted wallets ?
No it's not. Instead of private keys you will just get hashes of private keys instead.
There is a Python 2 script in Github called
keyhunter, which searches for base58 legacy private keys, and I used it to do a disk search on your wallet.dat and wallet_1.dat files, but it did not return any hits.
I am downloading the VHD file right now and when that's done I'll keyhunter that too. I think VHD stores the host filesystem directly in the file without any manipulation or compression or other weird hiding.