Assume you have deleted the harddisk image file of a running KVM guest with id 501.
You can restore the deleted image by following step.
1. Check where is the running process and its depends files
lsof | grep kvm | grep 501
2. locate the information
...
kvm 275741 root 13u REG 253,2 68719476736 63299585 (deleted)/var/lib/vz/images/501/vm-501-disk-1.raw
kvm 275741 root 15u REG 253,2 274877906944 63299587 (deleted)/var/lib/vz/images/501/vm-501-disk-2.raw
kvm 275741 root 16u REG 253,2 274877906944 63299586 (deleted)/var/lib/vz/images/501/vm-501-disk-3.raw
...
3. recover the image back!!!
cp /proc/275741/fd/13 /var/lib/vz/images/501/vm-501-disk-1.raw
cp /proc/275741/fd/15 /var/lib/vz/images/501/vm-501-disk-2.raw
cp /proc/275741/fd/16 /var/lib/vz/images/501/vm-501-disk-3.raw
Thanks