as far as the spc/msl, mmarz pointed out a way to find it in a qpst dump of the phone memory (no spc needed to read that part of the phone with qpst) over on xda...
his thread was concerned about having found his password in plaintext in multiple places in the dump, but he mentioned how to get the spc out of that dump, which address in which file, specifically. unfortunately, it dumps fine but won't write the same information back... but it's useful to read what's in there.
I haven't gotten anything I considered useful out of the qpst browser.
it's all files that would have to be decoded, not the filesystem as the kernel reads it.
I don't think it's actually the same part of the phone internals as you can get to with the recovery.
Now that you've brought it up, I have to go see now, because maybe that has something to do with radio settings, maybe not, but I have to satisfy my curiosity. I'll report back as to whether you can back up the ROM that way.
edit: the full dump is 512MB. probably contains the ROM and even the radio and nvitems.
I can't find any way to get the dump written back into a phone though.
the efs doesn't have but a few KB accessible with every pst I tried on it.