If you accidentally delete a disk image while VM is still running

If you delete a disk image on a running VM, you'll notice the VM might still be running even with the disk image gone... DO NOT STOP THE VM AT ALL!!! If you stop the VM, then you'll lose all traces of the disk image.
1) Firstly, you must remember the name of the disk image you deleted. We will refer to the deleted disk image as deleted.img
2) Use lsof and grep for the name or the former path of the deleted disk image.

lsof | grep /var/lib/libvirt/images/deleted.img
qemu-kvm   4097      qemu    9u      REG              253,5 30961696768        209 /var/lib/libvirt/images/deleted.img (deleted)

Now we know the process number of deleted.img. In this case, it is PID 4097.
3) Change directory to /proc/<PID of deleted image>/fd.

cd /proc/4097/fd

This directory will have an assortment of numbers. Do a long listing and find out which number corresponds to a symbolic link to the deleted disk image.

[root@tet fd]# ls -l 9
lrwx------. 1 qemu qemu 64 Aug  3 11:44 9 -> /var/lib/libvirt/images/deleted.img (deleted)

4) Once you found which number belongs to your deleted image, you will be able to copy it! But first, because that VM is still running, you must pause the machine but DO NOT STOP IT.
Use the command: virsh suspend <VM_Name>

virsh suspend deleted

If you want to resume a suspended VM, use: virsh resume <VM_Name>

virsh resume deleted

Once the VM is suspended, you can make a copy of the symbolic link and it will direct the copy command to the suspended VM: cp <number in /proc/<PID of deleted image>/fd. Choose a destination directory on a partition with lots of space since these images tend to be big!

cp /proc/<PID_of_deleted_image>/fd/<number_corresponding_to_deleted_image>  <directory_where_you_want_to_place_backup>
cp /proc/4097/fd/9 /tmp/recovered.img

5) After the VM is copied, perform a check on the disk image to ensure it was not corrupted. Copies of a disk image of a VM that is running will tend to be corrupted so hopefully you suspended it. Check the disk image integrity with: qemu-img check <disk image>

qemu-img check /tmp/restored.img 
No errors were found on the image.
Image end offset: 30925586432

6) With your restored image, you can now copy it into /var/lib/libvirt/images/. First, you want to stop the old VM from running since it is still using the old image and we have a new backup copy. Do:

virsh destroy <VM_Name>
virsh destroy deleted

Give your restored.img its original name when you copy it into /var/lib/lilbvirt/images so that the .XML file from /etc/libvirt/qemu will be able to find it.

cp <path_of_restored_disk_image> /var/lib/libvirt/images/<original_name_of_disk_image>
cp /tmp/recovered.img /var/lib/libvirt/images/deleted.img

7) Once the restored image is properly copied into /var/lib/libvirt/images, you can now start the restored VM!

virsh start <name of VM>
virsh start deleted