Qubes stores data in a luks encrypted LVM by default, with a VG of qubes_dom0 inside a thin provision pool called pool00. These are stored as thinly provisioned LV's by default, with the name vm-[qube-name]-private for appvms and vm-[qube-name]-private and vm-[qubename]-root for template vms. the -private lv is mounted inside the qube at /rw, and so contains the home directory, and anything in, say, /rw/config. -root is the / filesystem.
- Boot the machine in some live CD environment (recent Ubuntu LiveCDs work for this).
Install the lvm tools (lvm2 package, apt get install lvm2) and luks.
- Find the root (encrypted) hard disk using fdisk (or gparted, etc).
Unlock the disk using cryptsetup luksOpen [device path] disk
Verify that you can now see a /dev/mapper/disk that looks like an LVM PV
run pvdisplay and see if it detected the pv.
run vgdisplay and check to see if it detected qubes_dom0
run lvdisplay and see if it detected the lvs that you need.
Mount or copy off the data from the lvs from a device at /dev/qubes_dom0/[lvname]