Is it possible to restore an abstract file in the "cloud"?

Question

NTFS

The question is more theoretical.

Physical server, RAID 5, LVM on top of it, ext4 above LVM. This server has XEN/KVM with other fs containers as files. One of the containers contains the win server and NTFS inside. A 6 GB file is deleted from win and needs to be restored.

Does it make sense to run various data recovery utilities with so many abstractions over fs?
Where exactly do you need to interrupt writing to disk if it makes sense? (in a normal situation, you need to stop writing to a physical disk as soon as possible)

Answer 1

Do the same thing as in the usual case, stop writing to the Windows disk (apparently you have it in the file and you just need to disable Windows), cut it (the file with the disk) to another Windows (virtual machine) and run the program to restore files from ntfs.

Answer 2

I have not heard that from the guest system it was possible to transfer information about the released file system clusters (analogous to TRIM for SSD) to the host. Moreover, it would be a super killer feature to keep silent about it.
So everything that happens inside the operating system with files on an NTFS partition can be restored exactly according to the same business process as on real hardware. Actually, the virtual machine does not depend at all on what the data is physically located on, and the guest system works with the data as with one large file into which something is written.