The instance of the Express VI is saved as part of the VI that it is in. Normally a VI is saved with the information of what subVIs it has and how the wiring is done, etc. If it has an Express VI, it also has the Express VI saved as part of it. You can think of it as a modified llb.
But, I think the real problem you are trying to solve is not where is it, but how to access it. I am not sure.
If you use the LAVA site's scripting tools, maybe you can get a reference to the VI that contains it, then get the subVIs of that. One of them should be the Express VI that you are looking for.
Hope that this helps,
Bob