Based on @derobert's answer, I wrote a program (gist) that will parse an input stream from dd and scan each sector for something that looks like the start of an ext partition.
It will work at least as fast as dd can read from your hard disk. An abridged version is below.
The simplest usage is just sudo dd if=/dev/xxx | ext2scan, although you will likely want to modify the dd command to improve the block size or choose a region to search.
#include <unistd.h>#include <stdio.h>#include <string.h>int main() { unsigned char const MAGIC[2] = {0x53, 0xef}; unsigned char const ZEROS[512] = {0}; long long int sector = 0; char buf[4][512]; int empty1, empty2; while (read(STDIN_FILENO, buf[sector&3], 512) > 0) { if (!memcmp(buf[sector&3] + 0x38, MAGIC, 2)) { printf("Found a possible ext2 partition at sector %lld", sector-2); empty1 = !memcmp(buf[(sector-2)&3], ZEROS, 512); empty2 = !memcmp(buf[(sector-1)&3], ZEROS, 512); if (empty1 && empty2) printf(" (first two sectors are empty :)\n"); } sector++; }}Note: it will find not just the start of partitions, but also superblocks within them.
In either case, I would recommend using dumpe2fs to analyse the results. You can dump the start of the suspected superblock to a file (at least the first six sectors, according to my informal test), and if it is a superblock, then dumpe2fs will tell you (among other things) the relative locations of the other superblocks.
