Yes you can boot in TWRP if bootloader is unlocked:
fastboot boot /path/to/twrp.img
Then you can simply
dd whole eMMC or individual partitions. You need some extra memory (on external SD card) to backup whole eMMC or
/data partition. Smaller partitions (including the biggest one:
system) can be backed up to internal memory i.e. data partition.
For Qualcomm SoC:
(for MTK devices, path is slightly different)
dd if=/dev/block/(bootdevice/)mmcblk0 of=/path/to/external-sd/emmc-backup
For single partition:
dd if=/dev/block/bootdevice/by-name/userdata of=/path/to/external-sd/data-backup
In order to come up with shortage of space, instead of using SD Card you may save backup files directly to PC using
adb shell or
exec-out. Thanks to @Izzy:
adb exec-out dd if=/dev/block/(bootdevice/)mmcblk0 > emmc-backup.img
Make sure your
adb binary (on Windows or Linux) supports exec-out. Also take care that unwanted non-printing terminal characters don't get included in output.
There are also other methods like
adb pull, UMS or streaming over network. For details see How to recover a deleted file from /data partition?
Another way to save space and to speed up backup process is to backup only the contents of mountable filesystems instead of whole partition image. Particularly
system are larger partitions but they aren't usually completely filled. Mount them and create backup archive using
tar so that zeroed out portion of these partitions isn't backed up.
Make sure to preserve all file permissions and attributes (whatever applicable depending on filesystem etc.) including classic UNIX file mode and owner, ACLs, XATTRs and SELinux contexts. These options are supported by
tar. Otherwise things might get messed up. See more details in How to stream an encrypted backup of the entire device to remote host?