Method to flash any NR7101

Continuing the discussion from Flash on Zyxel NR7101:

Yes i want to try go back to telenor firmware. I do not have any backup file of them, but not sure if they are overwritten with the zycast. ?

How can i try to boot from recover partition?
I tried cat /dev/mtd5 > /tmp/backup.bin
then mtd -r write /tmp/backp.bin Kernel and reboot, but still openwrt. Is there somehow to verify if i still have the stock firmware in recovery partition?

root@OpenWrt:/tmp# [ 1486.444177] mt7530 mdio-bus:1f lan: Link is Down
[ 1486.453884] br-lan: port 1(lan) entered disabled state
cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "Bootloader"
mtd1: 00080000 00020000 "Config"
mtd2: 00040000 00020000 "Factory"
mtd3: 01ec0000 00020000 "Kernel"
mtd4: 01ac0000 00020000 "ubi"
mtd5: 01ec0000 00020000 "Kernel2"
mtd6: 00100000 00020000 "wwan"
mtd7: 01000000 00020000 "data"
mtd8: 00100000 00020000 "rom-d"
mtd9: 00080000 00020000 "reserve"
root@OpenWrt:/tmp#