Even if you used something like Helix live cd you would still have to MOUNT the os so i am still at a loss as to get a dump of the os without some kind of investigative method being used.