You can grab an image in telnet shell: (image of bootloader, kernel, root and recovery - not of user data, that you can grab with clonezilla or whatever)
Code:
head -c $((512 * $(cat /sys/block/mmcblk0/mmcblk0p3/start) )) /dev/mmcblk0 > /mnt/onboard/mmcblk0.rawimg
this assumes mmcblk0p3 is the user data partition so it grabs everything *before* that and stores it on the user data partition (need ~1G of free space)
but since this image is taken while the system is running, there may be an issue with filesystem consistency in the image, so it might require post-processing
however it should be "good enough" for recovery purposes (at most you'll have to run it through another factory reset)