I'd be tempted to cp /proc/kcore haystack and have a look through it. (This is the method I've used to recover accidentally deleted emails a few times.)