Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
On a bit-level, nothing stops an attacker with local access from copying the bits on your hard drive or SSD. In fact, there is hardware designed to create exact images of disks and SSDs, though this is usually done for forensic purposes.
How useful those bits are depends on how your hard drive is set up. Without any encryption applied, the attacker can use the filesystem present on the disk image to read the files - just how your computer would do it. Even without an intact filesystem, techniques like "file carving" can be used, where common headers for files are searched. Basically, you look for something that looks like the beginning of an image, and then attempt to read the next sectors as if they were an image. And in the end, you may end up with a usable image, or junk.
This can be protected against with encryption. Generally, there are two kinds of common encryption methods: File-based encryption and full-disk encryption. File-based encryption means the contents of some files are encrypted, and full-disk encryption means everything on the whole volume is encrypted.
With both of these, the problem now becomes key management. For full-disk encryption solution like BitLocker, keys can be generated with a passphrase and an additional TPM component. For file-based encryption, as it is used on modern Android phones, you can either use a similar approach, or use individual keys for each file, depending on your requirements.
Physical access is usually a huge security issue, depending also on your threat model or, in other words, what the attacker is willing to do with your machine.
Full disk encryption is a great security control if your machine is stolen (while turned off), to prevent the attacker from reading the contents of your HDD. You will never use the stolen machine anymore, it's gone. But if the attacker is able to compromise your machine, for example by replacing the disk and the OS (and show a fake prompt), or by installing a hardware keylogger, etc. and then you are going to use that machine again, then full disk encryption won't help. In theory some encryption methods don't protect integrity, so a very skilled (and lucky I guess) attacker could even be able to change some data on your encrypted HDD. And some encryption methods don't encrypt everything, but there might be unencrypted stuff on your disk (like bootloaders, etc.) that could be compromised (unless you have secure boot turned on, I guess).
If the attacker in your scenario is only going to turn on the PC, see it's encrypted, and give up, then full disk encryption is going to be enough. You might also want to disable boot from external devices, and password-protect the firmware. However if the attacker you are dealing with is willing to disassemble your machine, replace hardware, or spend a lot of time and resources to pull off the hack, then full disk encryption won't help you much (but it's always a good thing to have by default, anyway!)
Yes, someone could clone your entire hard drive, but this usually takes a long time. An attacker would have to open your computer's case, remove the drive, plug it into a dock, clone its contents, then return it to the case and hope you don't notice. Or alternatively, boot your computer using removable media, and then clone the drive over the network or to some other form of removable storage. Either way, it takes a fair amount of time and effort, so the attacker would have to be confident that you're not returning any time soon.
Far more convenient would be browsing the drive and cherry-picking files that look interesting. That requires a different level of access, but less time.
Both attack vectors can be impeded by encryption, as mentioned by others. The cherry-picking method can also be impeded by obfuscation, such as hiding your top secret files in a directory named "Financial Reports, 2004-2005" (unless, of course, your top secret files actually ARE financial reports, in which case you should hide them under "Pirated episodes of My Little Pony"). Encryption can definitely help here, too, but remember that someone who has access to your computer also has access to the post-it notes stuck to your screen, so be very careful with your password.
Yes, it is possible to clone drives using some external connector (SSD/HDD usb connectors/Tableau Hardware) and software (osf/winhex). Cloning can be done in both states. It takes 30 - 40 min depends on size of hard drive and respective machine.
Bitlocker (whole disk encryption) can help to manage risks.
An often overlooked part of Information Security. Lock the PC down by disabling external ports (USB, Serial, etc), and physically secure the PC so they cant take it or open it. Have a chassis intrusion switch that is tied to an alarm, and put the machine in a secure enclosure.
You could protect the drive with a password (I mean a bios unlock password, sometimes called DriveLock or ATA password, not a bitlocker-type full disk encryption). Such drives won’t accept any commands until unlocked. However it’s not very reliable and replacing the drive logic board is know in some circumstances to dwarf this protection.
FDE alone won’t protect attackers from copying the disk image, but they might not be able to get the encryption key.