A small Python repo claims to decrypt VMware Workstation and Fusion .vmem, .vmsn, .vmss, and .nvram files when you have the VM password. The sharp part is the operational detail around AES-CBC pages, the non-XTS label mismatch, and why Volatility needs a flattened .vmem paired with the decrypted .vmsn.